Similarly to how we moved the webfinger functionality to go-ap/webfinger, we should move the OAuth server to a separate project.
This will ensure that we can migrate to something like Kratos down the road.
We should probably use FEP-d8c2
Added #299 for tracking FEP-d8c2 improvements.