Add Bluesky support

[fluffy-critter]

Bluesky is getting pretty popular and now supports OAuth.

My understanding is that there's no need for client registration, it just does something IndieAuth-esque where the client_id is a link to a metadata document. This document would probably be best configured as a URL that is then filled out by the site operator, rather than trying to shoehorn it into Authl itself, although in the long term it would be worth investigating a flow for allowing handlers to provide sideband data in some framework-agnostic way.

There's also a butt-ton of Python bsky client libraries in various states of support, although they all seem to use the legacy username/password auth flow rather than OAuth, which is not appropriate for Authl.

[fluffy-critter]

It looks like the OAuth spec isn't quite ready for prime time, as they're still working on defining the scopes, among other things. The actual setup of client metadata is also just halfway there.

https://github.com/bluesky-social/cookbook/blob/main/python-oauth-web-app/README.md has a minimal example of how to build something that uses the full secure scopes, but that's beyond the, uh, scope of what I want/need for Authl.

[fluffy-critter]

My most recent experiments found that while the OAuth flow exists, it's very much not geared towards an SSO thing, as it makes a lot of security assumptions that assume that anything requesting OAuth is going to be behaving as a fully-fledged read-write client. So in particular signin with bsky results in an extremely onerous set of warnings (which make sense in a client context) as well as a validation flow where the user has to re-enter their password, somewhat defeating the point to an SSO flow and leading to more user concern.

Hopefully at some point bsky adds an SSO/profile-only flow, but at present it still isn't there.

bsky also has the potential issue when it comes to dealing with alternate DID providers, for example I've got no idea how one would do bsky auth against anything that isn't hosted by bsky.social. An obvious example of that being fed.brid.gy, although that's possibly a bad example since most users using that DID would likely have another auth mechanism available anyway (e.g. Mastodon/Pleroma or IndieAuth).