feat(core-api): role based access control through oauth2 scopes

[petermetz]

Is your feature request related to a problem? Please describe.

I want to be able to configure the API server with an arbitrary OAuth2 identity provider so that it's easy to plug Cactus plugins into existing infrastructure and at the same time Cactus itself does not have to be burdened (for now at least) with providing a full implementation of an identity provider itself.

Describe the solution you'd like

1. API server can be configured with OAuth2 provider parameters such as this example [1] as seen at the official docs of the passport js oauth 2 strategy documentation: https://github.com/jaredhanson/passport-oauth2
2. OAuth2 scopes work as well (and are checked for so that effective RBAC is implemented)
3. The web service plugin interface is updated with functions to allow for finer control, for example the plugin instances should be able to specify themselves what scopes they need and also if they wish to be secure endpoints or not (e.g. can anonymous users hit it or not)

[1]

{
    authorizationURL: 'https://www.example.com/oauth2/authorize',
    tokenURL: 'https://www.example.com/oauth2/token',
    clientID: EXAMPLE_CLIENT_ID,
    clientSecret: EXAMPLE_CLIENT_SECRET,
    callbackURL: "http://localhost:3000/auth/example/callback"
  },
  function(accessToken, refreshToken, profile, cb) {
    User.findOrCreate({ exampleId: profile.id }, function (err, user) {
      return cb(err, user);
    });
  }

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context

This came up during the work on #540 and is also heavily related to all the other identity related tasks that we have defined so far. The idea here is to do the absolute bare minimum that we need for a release candidate that we can honestly stand behind and say it is ready for production.

#546
#144

cc: @takeutak @sfuji822 @hartm @jonathan-m-hamilton @AzaharaC @jordigiam @kikoncuo @jagpreetsinghsasan