Use OAuth authorization flow in client

[robertknight]

When the OAuth login feature flag flag is enabled for the client, the OAuth authorization endpoint should be used instead of cookie-based authorization.

When this flag is enabled, the client should:

1. Not use the cookie-authenticated GET /api/token endpoint to retrieve cookies.
2. Display the authorization page when the user clicks the "Login" button in the client
3. Exchange the authorization code for an access/refresh token when the user completes login.

Persistence of access/refresh tokens will be part of a separate issue.