Add support for default timeout in OAuth2Session

[lotvall]

What kind of change does this PR introduce? (check at least one)

• [ ] Bugfix
• [x] Feature
• [ ] Code style update
• [ ] Refactor
• [ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

• [ ] Yes
• [x] No

---

• [x] You consent that the copyright of your pull request source code belongs to Authlib's author.

This is related to #451 - It resolves the issue that it's not possible to send a timeout when fetching server meta data or jwk keys.

This fix uses a default timeout on every request, when timeout is provided to the OAuth2Session.

If you have a different way you'd prefer to propagate timeout to the request please let me know, would be happy to amend accordingly.

[lepture]

Thanks