oauth: use a context manager for the server's thread

[woodruffw]

WIP.

Closes #139.

Signed-off-by: William Woodruff william@trailofbits.com

[woodruffw]

This should be good to go.

Key changes:

• Adds two new classes: OAuthFlow and OAuthSession. The former manages the entire flow lifecycle (including local HTTP server startup and teardown); the latter contains all of the state needed to create and verify an OAuth handshake.
• The new OAuthSession API is slightly more misuse-resistant: it's idempotent across calls, and includes a poison state that catches potential misuse (e.g. someone attempting to generate the same OAuth request URL multiple times).

[woodruffw]

This PR also preserves the "forced OOB" functionality that was already present, but I'm starting to think that it should be a CLI flag instead of an environment variable. So I can include that in these changes, if desired.