Update to oauth-sign 0.9.0

[dlecocq]

PR Checklist:

• I have run npm test locally and all tests are passing.
• I have added/updated tests for any new behavior.

References

#2627

PR Description

Bump the version of oauth-sign to 0.9.0

[dlecocq]

@simov - while there's still context for it, this is a follow-on to request/oauth-sign#23

[simov]

Thanks, @dlecocq!