Integrate OAuth2 Provider

[jonasfranz]

I'm currently integrating an OAuth2 Provider in Gitea. I'm using RFC 6749 as model. Currently only the Authorization Code Flow gets implemented due to security concerns for the other flows. I also plan to implement the PKCE Extension to support mobile and "serverless" clients.

Scopes is not a part of this PR and will be integrated until scopes are implemented in general.

I'm open for contributions and feedback. The current code is not final and is absolutely subject to change.

Resolves #27.

TODO:

• Database Structure
• Authorization Endpoint
• Access Token Endpoint
• Access Token validation (middleware)
• Refresh Tokens
• PKCE
• Application Settings UI
• Authorize UI (just basic UI, @kolaente will improve it)
• Well known routes will be implemented in another PR
• Tests, Tests, Tests, Tests
• ....

[jonasfranz]

@filipnavara @lafriks I've reworked the access token system.

• Access and refresh tokens are now JWTs
• access tokens have a limited lifetime of 3600s (defined in config)
• refresh tokens have a lifetime of ~1 month (defined in config)

An additional access token middleware must be added to the api but is not implemented yet.

[techknowlogick]

make LG-TM work

[techknowlogick]

Thanks @jonasfranz!!!

[jolheiser]

🎉

[0x5c]

Awesome! \o/

[raucao]

[sapk]

Looking at this code for rewriting to an other router lib, I think this is not working as expected (anymore ?).
Since we call Validate with a empty errs list.

// Validate validates the fields
func (f *AuthorizationForm) Validate(ctx *macaron.Context, errs binding.Errors) binding.Errors {
	return validate(errs, ctx.Data, f, ctx.Locale)
}

That will be return immediately without any check.

func validate(errs binding.Errors, data map[string]interface{}, f Form, l macaron.Locale) binding.Errors {
	if errs.Len() == 0 {
		return errs
	}
    ...

But I am maybe mislead and I really don't know how the forms Validate functions should really work.