OAuth2 authorization

Dask provides a [TLS](https://distributed.dask.org/en/latest/tls.html) client-scheduler secure connection mechanism that can serve double duty as a client authentication mechanism. However, x509 certificate+key pairs for both server and client can be cumbersome to set up, especially if many different users need to authenticate. A popular authentication flow these days is [OAuth2](https://oauth.net/2/) allowing to factorize authentication, authorization, and access to resources. It would be nice if a dask Security object implementing OAuth2 for client authorization to the scheduler were available. Then any subsequent communication would put the auth token in the headers. Note this does not help with connection security, which probably would best be served by 1-way TLS as used widely in https.

An alternative to putting OAuth support in distributed natively, after the introduction of websocket protocols thanks to @marcosmoyano in https://github.com/dask/distributed/pull/4396, is to put a reverse proxy in front of the scheduler to authorize access, as there are reverse proxies that can handle authorization, e.g. [nginx](https://www.nginx.com/blog/validating-oauth-2-0-access-tokens-nginx/).

@oshadura @bbockelm @jacobtomlinson