Authentication "Log" message should be printed to STDERR instead of STDOUT, to avoid breaking shell scripts which redirect output

I'm using (something more or less like) the following inside a bash script:

oauth2l curl --scope tasks.readonly --url https://tasks.googleapis.com/tasks/v1/users/@me/lists --credentials credz.json >task-lists.json

Every 15' or so, when I it launches the Web Browser login thing, to refresh the token, which is successful (!), that `task-lists.json` file is "broken", and I have to manually fix it, because instead of containing valid JSON, it starts with:

```json
Your browser has been opened to visit:

https://accounts.google.com/o/oauth2/auth?client_id=...

{
"kind": "tasks#tasks",
```

This is because `oauth2l` writes both it's "real output" (JSON) as well as it's "diagnostics bla bla" to STDOUT.

IMHO, it would be better if "Your browser has been opened to visit:" and what not were written to STDERR instead of STDOUT?

Code to be changed from `fmt.Println` to `fmt.Fprintln(os.Stderr, "...")` is [here](https://github.com/google/oauth2l/blob/5ecd9398743c45f8ec609796a39642bf8319cd93/util/auth-handlers.go#L90)

Would you welcome a PR fixing this?