OAuth2 Owner Credentials flow now matches specification

[krotscheck]

Resubmission of #3913. I'll try to keep the branch safe from my autocleanup scripts until it merges.

Description

This pull request updates the "Password" flow to match the RFC, in
accordance to #3227, with the following changes:

• Two methods have been explicitly removed (though names have been repurposed): Using login/pass in Basic Auth and including client_id and client_secret in the query string. The former has been removed because it is not in the specification at all, the latter because it's explicitly discouraged.
• The "Basic" auth method now uses the client_id and client_secret in the Authorization header, via Basic auth, in accordance with RFC section 2.3.1: https://tools.ietf.org/html/rfc6749#section-2.3.1
• The "Request Body" auth method now adds the client_id and the client_secret to the form body, in accordance to section 3.2.1: https://tools.ietf.org/html/rfc6749#section-3.2.1
• The form no longer hides the client_id or client_secret.

Motivation and Context

• Security: Putting client_id and client_secret in the query string will be cached by the browser, which is insecure.
• Fixes OAuth2 Password Flow modes do not match RFC #3227
• Usage: I want to add Password-based swagger UI to an OAuth2 server that I've built, and the implementation doesn't actually match the spec.

How Has This Been Tested?

I created a custom build including my fixes, and hosted them off of an OSS OAuth2 compliant authorization server, then validated that both private and public password-based clients could authenticate.

Types of changes

• No code changes (changes to documentation, CI, metadata, etc)
• Dependency changes (any modification to dependencies in package.json)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

[shockey]

Welcome back! We're focusing on cleaning out our PR and issue backlog this week, so this should move quickly 😄

[shockey]

Closing, as almost all of this ended up in #5066.

Thanks for your efforts, @krotscheck! Even though your PR didn't hit master, it made an influence 🙂