Move from OAuth 1.0a to OAuth 2.0 for OSM logins

OSM's OAuth 1.0a is in the process of being deprecated, as discussed at openstreetmap/operations#867.

No timeline has been set, but we do not expect to shut off OAuth 1.0a this year. It would be good to move to OAuth 2.0 well before this time.