Support OAuth 2.0 device flow

I suggest that this plugin optionally support the [OAuth 2.0 device flow](https://tools.ietf.org/html/rfc8628) for authentication. This avoids needing to have a callback to a web server on the client's machine and is much easier to manage from the command line.

Start by reading RFC 8628, which the issue links, and inspect the repository's existing JWT and OIDC authentication entry points. Define how the optional device flow should fit the plugin and how command-line users would complete authentication; the issue does not name files, tests, or acceptance criteria.

Written by the indexing model from the issue text.