oauth api: tighten client validation
oauth api: tighten client validation

Additional checks in client object:
- no secret in client's additionalSecrets is empty
- if accessTokenMaxAgeSeconds is set, check that it's a 0+ integer
- ensure that grantMethod is not empty
- restrict the possible values for grantMethod to "auto" and "prompt"
  (removes "deny")

sallyom/origin,spadgett/origin,JacobTanenbaum/origin,deads2k/origin,mkumatag/origin,jeremyeder/origin,pecameron/origin,bparees/origin,pweil-/origin,coreydaley/origin,ironcladlou/origin,Miciah/origin,deads2k/origin,openshift/origin,tnozicka/origin,csrwng/origin,akram/origin,coreydaley/origin,jeremyeder/origin,pweil-/origin,spadgett/origin,spadgett/origin,anpingli/origin,hroyrh/origin,gabemontero/origin,mahak/origin,soltysh/origin,dinhxuanvu/origin,dinhxuanvu/origin,akram/origin,openshift/origin,sallyom/origin,mkumatag/origin,sjug/origin,bparees/origin,sjug/origin,tnozicka/origin,hroyrh/origin,xiuwang/origin,openshift/origin,mkumatag/origin,dinhxuanvu/origin,sdminonne/origin,soltysh/origin,nak3/origin,tnozicka/origin,bparees/origin,ingvagabund/origin,pecameron/origin,jeremyeder/origin,pecameron/origin,jsafrane/origin,sjug/origin,ironcladlou/origin,nak3/origin,ingvagabund/origin,enj/origin,gabemontero/origin,mfojtik/origin,jeremyeder/origin,mahak/origin,csrwng/origin,dinhxuanvu/origin,JacobTanenbaum/origin,mfojtik/origin,spadgett/origin,Miciah/origin,anpingli/origin,ingvagabund/origin,jsafrane/origin,akram/origin,enj/origin,jim-minter/origin,jim-minter/origin,pweil-/origin,hroyrh/origin,spadgett/origin,xiuwang/origin,dinhxuanvu/origin,sdminonne/origin,soltysh/origin,sdminonne/origin,anpingli/origin,enj/origin,mfojtik/origin,csrwng/origin,jim-minter/origin,sallyom/origin,tnozicka/origin,jeremyeder/origin,ironcladlou/origin,tnozicka/origin,tnozicka/origin,deads2k/origin,mahak/origin,Miciah/origin,JacobTanenbaum/origin,jsafrane/origin,xiuwang/origin,gabemontero/origin,nak3/origin,coreydaley/origin