Add oauth2 client for trigger authentication with event sources

today we require username/pw to be passed on to a trigger. we should offer the ability to avoid that by allowing authentication with oauth2.

The issue names no files, tests, or entry points. Begin by locating trigger authentication and event-source handling, then clarify the OAuth2 flow, supported configuration, and acceptance tests before implementation; done means event sources can authenticate without passing a username and password.

Written by the indexing model from the issue text.