Implement device oauth flow for CLI

[DavidS-ovm]

• https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow
• https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow/call-your-api-using-the-device-authorization-flow
• ovm-cli already has an app ("cli" in Auth0
• ensureToken already does some auth when there is no API key, but doesn't do device authz
• needs "OIDC Conformance" enabled on the Auth0 Application
• needs to set "Token Endpoint Auth Method" to "none"
• switch ensureToken to use https://pkg.go.dev/golang.org/x/oauth2@v0.17.0#Config.DeviceAuth and friends

To reduce interruptions to users the above changes should happen on a new Auth0 app, so that everything works with the device flow when downloading a new version of the CLI.