Abstract out tokens from being tied tightly to access

[bradjones1]

Some OAuth2 clients also support OpenID Connect (OIDC.) Also, some native app integrations (e.g., Google) directly return OIDC ID tokens to the native app, which then can be used by a backend for SSO. You get the idea.

There are some other issues/PRs open for OIDC functionality, e.g. #899, and those are good starts for sure. I think what is missing from at least that PR, and more generally, is the ability to represent tokens in a more abstract way. E.g., an OIDC ID token represents a resource owner, but does not contain an access token. This can also lead to some confusion like in #976.

See also thephpleague/oauth2-google#119 for the Google provider, which is an example of how these libraries can be augmented with ID token support to better serve as a backend for all types of SSO implementations, not just browser-based OAuth2 flow.

[bradjones1]

I realize the code style is a bit messed up here but am jamming on a project and figure if maintainers are into this, it's easy enough to clean up. Would perhaps be nice to ship some composer commands to do CS linting and fixing locally.