add challenging authentication needed for cli

Adds the ability to issue authorization challenges back to callers of /authorize.  This is done based on the value of client.RespondWithChallenges which indicates that a particular client wants to be challenged for responses instead of being redirected.

This also adds a few new cli commands (request-token, validate-token, whoami) to exercise the new capabilities.  Right now, the command line client only recognizes basic auth challenges, but the code point for future extension to other challenges is present.

@liggitt review
> At the cost of duplication of code I guess.

If we're going to make use of the oauth/info endpoint, we need a new type either way.  Neither osin, nor osincli, contain a type that represents the information returned by /info.  If we aren't going to expose it, then we should just disconnect it entirely.  For now, I separated out the type into a different package