oauth: What additional metadata should the discovery endpoint provide?

[aragilar]

We could specify that the additional metadata be included in the JSON response,
and/or use the OIDC discovery mechanism (uses .well-known) and/or the OAuth 2
discovery mechanism (basically same response as OIDC discovery).

See #22 for context.