Replace OAuth 1.0 signature verification implementation

The LTI launch process involves verifying OAuth 1.0 signatures. For this purpose we currently use the PyLTI library which mostly delegates to a, confusingly named OAuth 1.0 library, [python-oauth2](https://github.com/joestump/python-oauth2/issues). The python-oauth2 library is not actively maintained and we've had to work around bugs in it (see https://github.com/hypothesis/lms/pull/764). PyLTI has only been "lightly maintained" recently.

OAuth 1.0 signature verification is complicated enough that we don't want to roll our own. We should replace the [signature verification](https://github.com/hypothesis/lms/blob/414fd17caec005a62421b34af74622012bc97126/lms/services/launch_verifier.py#L64) with an actively maintained library. [oauthlib](https://github.com/oauthlib/oauthlib) is already used in tests and looks like a good candidate. It also supports OAuth 2 which we may need in future to support LTI v1.3 and also for interactions with LMS APIs.

[Related Slack discussion](https://hypothes-is.slack.com/archives/C4K6M7P5E/p1562589567003600)