SNOW-1825495 OAuth flows implementation

[sfc-gh-mkeller]

Please answer these questions before submitting your pull requests. Thanks!

1. What GitHub issue is this PR addressing? Make sure that there is an accompanying issue to your PR.

   Fixes SNOW-1825621

2. Fill out the following pre-review checklist:

   • I am adding a new automated test(s) to verify correctness of my new code
   • I am adding new logging messages
   • I am adding a new telemetry message
   • I am modifying authorization mechanisms
   • I am adding new credentials
   • I am modifying OCSP code
   • I am adding a new dependency

3. Please describe how your code solves the related issue.

   In this PR I add support for OUath authorization code flow. It's very similar to external browser authentication, but it uses oauth and more options are more better for users.
   This change has been tested manually, as it's fairly complicated to setup and we don't do unit tests for the different authentication methods.

4. (Optional) PR for stored-proc connector: Not applicable

[sfc-gh-eworoshow]

Great!

A couple over-arching thoughts:

• I only really looked at the security semantics, we should have additional reviewers for the Pythonic HTTP bits.
• Ideally we find some way to add automated tests for this flow. Do we have browser automation testing, for example, that we could use to build an integration test?

[sfc-gh-mkeller]

Do we have browser automation testing, for example, that we could use to build an integration test?

We do this manually when we mess with the authentication code, otherwise we just don't touch these pieces of the code and we don't test them. None of them have any dependencies outside of std lib, so there's no need to

[sfc-gh-eworoshow]

Broadly LGTM modulo a few minor comments!

We should have the "new owners" take a look too. This is complex and sensitive enough that I think it benefits from additional eyes.

[sfc-gh-eworoshow]

Nice! Stamped.

I'd really love more eyes on this, however. Can we perhaps involve the team taking over this driver to take a second look? There's enough security-sensitive handling here that more than one reviewer is ~necessary.

[sfc-gh-jszczerbinski]

Can you provide some testing? I think it can be done pretty easily. We could inject fake/mock webbrowser object and access token request? The fake web browser could do a redirect call immediately (extracted from the url).

My requests were addressed