Web redirect options

[aaronpk]

Two options for web redirect fallback:

• Should we return a PAR URI and the client starts the web flow with a PAR request URI? Scopes would have already been requested before this point.
• Should we return a device session and then start a new OAuth flow (either PAR or normal). Client would also request new scopes for this flow.

[aaronpk]

In either case, we want to make sure that the user can resume the flow without having to start the UX from scratch. We don't want the user to have to re-enter their username or anything, just jump into the middle of the flow in the browser.

[PieterKas]

Aaron's suggestion - describe how it should be done, and then point out this is compatible with PAR.

[aaronpk]

Done in #38