Implement state provider for OAuth2 protocol

Currently, to prevent the client for CSRF attacks as described in the [OAuth2 RFC](https://tools.ietf.org/html/rfc6749#section-10.12), the OAuth2 provider stores the state on the application side in the cache. So when using a clustered environment a distributed cache instance must be used. This pull request removes this cache dependency in favor of an abstract solution to handle the state on applications side. It comes with a session state provider that can store the state in the session to follow Play's stateless approach.
(Perhaps rename to OAuth2State? Might simplify a tiny little bit for other people who open the cookie tab in Chrome Dev Tools, and wonder "what's that?")