oauthex: oauth discovery checks

[yarolegovich]

add extra checks for the default oauth discovery client:

• disallow redirects which downgrade to http
• disallow redirects to localhost or private ip
• disallow the initial call to a private ip
• proxy configuration opts out of dial time checking