feat: implement OAuth2 webhook authentication as alternative to HMAC

[kojiromike]

Add OAuth2 as an alternative webhook authentication method (in addition to HMAC secret token from the previous issue).

Sinch Conversation API supports OAuth2 client credentials flow:

1. Sinch obtains tokens from our token endpoint using client ID and secret
2. Short-lived access tokens (typically 1 hour) are sent as Authorization: Bearer {token}
3. Configurable: scope, token_request_type (BASIC or FORM)

Sinch recommends OAuth2 for production. Implement this as an option alongside HMAC.

This requires adding a token endpoint to the module and storing client credentials.