Implement Hybrid OAuth2 flow

Google's OAuth2 implementation aligns with the OpenID Connect specification, see
[0]. The OpenID Connect specification, see [2], describes Hybrid Flows. The one
implemented in this CL is using the "code token" response_type values (Google's
supported response_type values can be found in [1]).

As with a normal browser-based immediate flow, the googleapis_package uses
gapi.auth to obtain user consent. But when doing so it will request offline
access and it will request the "code token" response type.
After the user has given his consent, the developer can post the obtained
authorization code to the server. The server has the `client_secret` of the
ClientId and can use it to exchange it with long-lived access credentials (which
includes a refresh token).

Further details:
[0] https://developers.google.com/accounts/docs/OAuth2Login
[1] https://accounts.google.com/.well-known/openid-configuration
[2] http://openid.net/specs/openid-connect-core-1_0.html

R=sgjesse@google.com

Review URL: https://codereview.chromium.org/598983002