Move `bb_api` and `oauth` out of providers.json

[jmandel]

... and document a separate {provider_uri}/.well-known/bb-provider.json discovery endpoint, hosted by each provider, with a value something like:

{
   "authorize_uri": "http://portal.goodhealthclinic.org/authorize",
   "token_uri": "http://portal.goodhealthclinic.org/token"
   "summary": "http://api.goodhealthclinic.org/patient/documents/summary",
   "search": "http://api.goodhealthclinic.org/patient/documents/search"
}