Rework strategy to handle OAuth and OIDC

[hzalaz]

• Reworked how it's built, it nows require client_id, client_secret and auth0 domain
• Handles absence of id_token
• By default sets no scope or audience
• Parses /userninfo response and handles non-oidc payload