Add support for HMAC-SHA256 (builds on PR#388)

[ViktorHaag]

This pull incorporates changes from PR #388 as it appears orphaned.

I cleaned up the comments for the HMAC-SHA256 signing method, and added tests for the SHA1 and SHA256 signing methods (I verified the signature generation code against node's oauth-1.0a and crypto modules, to be satisfied that the test signature values were valid).

[lepture]

There is no such thing in RFC5849.

[ViktorHaag]

Agreed. Note that my comment didn't claim it was in RFC5849, but defined in RFC4634 (as one of the suite of accepted Secure Hash Algorithms beyond SHA-1).

I took 5849's provision of three signature methods as not exclusive. In section 3.4, it says "OAuth does not mandate a particular signature method" (my emphasis), and so it seems useful, with little harm, to add support for SHA2-family signing methods.

If the maintainers would prefer to have clients add support for more modern signing methods via extension, rather than provided in the library, I can understand that decision. I would have thought having the support in-library would at least help clients ensure consistency, but it's clearly not my decision.

[lepture]

@ViktorHaag See my comment. There is a register function to extend signature methods. The folder is named as rfc5849, things beyond this scope should not be included.

cc @thedrow @ib-lundgren

[ViktorHaag]

Yes, I understand your point. I had assumed from the comments in #388, that the blocking factor here was a lack of testing and documentation, and not the idea in the first place. It was for that reason that I decided to help by "finishing" the original PR. If the maintainer group would prefer not to include it, that's fine: I'm glad there is a way to extend the package usefully.

[lepture]

Actually there is a way to register your own signature method.
https://github.com/idan/oauthlib/blob/master/oauthlib/oauth1/rfc5849/__init__.py#L52

This HMAC-SHA256 is not a part of the specification in RFC. This patch should not be included in this repo.

[thedrow]

I have given this some thought.
I don't see the harm in providing this implementation to our users.
It's a pretty common usecase.

[thedrow]

Thank you @ViktorHaag @mick88
Feel free to add yourselves to the AUTHORS file.

@lepture If you strongly disagree let's chat about this over email.
We can always revert before making a new release.