Consolidate/streamline 3rd party integrations configuration?

As an open source project we're in a weird place when it comes to 3rd party integrations using OAuth because the admin must both create OAuth client id/secret _and_ go through the normal OAuth flow. It would be nice if we could streamline that experience as much as possible.

With the addition of the Google Analytics driver we now have 3 different places that require a Google OAuth client ID and secret (Auth, BigQuery, GA), but there's no reason we couldn't use the same one everywhere.

It would be nice if the admin only had to create and configure the OAuth client id / secret once. They would still go through the auth flow to authorize different scopes and get different access/refresh tokens for different features, but they wouldn't have to create new credentials and copy them every time.

Once we do that we should switch the BQ/GA setup flow to use the redirect flow rather than copying the code (i.e. `urn:ietf:wg:oauth:2.0:oob` "redirect uri"), since the admin will have configured the correct redirect URI.

No files, tests, or entry points are named. Start by mapping the separate OAuth configuration and authorization flows for Auth, BigQuery, and Google Analytics, then determine how shared client credentials and redirect-based setup should work; done means one admin configuration supports the integrations while preserving their separate scopes and tokens.

Written by the indexing model from the issue text.