add support for OAuthContactTokens, with tests, upgrade step, new permissions

add support for OAuthContactTokens, with tests, upgrade step, new permissions

Per discussion with @totten, re the logic that interprets "tag" and links/creates contacts accordingly: in earlier versions of this code, I had put that logic in OAuthTokenFacade. Moving it to the api4 "create" action means it will happen even when a ContactToken is created outside the OAuth flow. I decided not to put it in BAO writeRecords() because then it would run too late for the permissions checking we do in the api4 Create action.

Note: the permissions change here means that some current users of the OAuth Extension will need to enable an additional permission to allow for the acquisition of new tokens through the auth-code flow.