Support OAuth2 authorization via PIN

[margaretha]

Kustvakt should support OAuth2 authorization via PIN (or other kind of code) activation, for instance to facilitate login in "IDS Wortraumstation" using virtual reality (VR) tools. The authorization process involves two KorAP front-end instances, e.g. VR app and Kalamar for the browser. The general flow is:

1. VR app shows PIN and sends a poll request with username & PIN to Kustvakt.
2. User login to Kalamar and activate PIN in Kalamar.
3. Kustvakt matches username & PIN from VR app & Kalamar, and sends response with an access token to the VR app

To achieve this, two additional web-service are needed for:

1. poll requesting oauth2 token using pin and username
2. pin activation requiring user authentication in the authorization header

This issue is related to KorAP/Kalamar#101.

[notesjor]

In my opinion, a better solution would be to use signed JWT (public/private key). This is safe and easy to implement.