OAuth2 and security related improvements

[dryewo]

• Fix #86 (allow static tokens for testing via OAUTH2_ACCESS_TOKENS, don't require OAUTH2_ACCESS_TOKEN_URL).
• Fix #89 (To qualify as namespace, require env var prefix to end with _ when loading configuration) .
• Don't let Tokens library use CREDENTIALS_DIR env var directly, to support reloaded workflow.
• Separate incoming token checking functions and service token refreshing component into different namespaces.
• Improve configuration loading to support arbitrary mappings, not only TOKENINFO_URL -> HTTP_TOKENINFO_URL and CREDENTIALS_DIR -> OAUTH2_CREDENTIALS_DIR

[harti2006]

:+1:

[dryewo]

👍