mod_http_oauth2: Implement the Implicit flow Everyone says this is insecure and bad, but it's also the only thing that makes sense for e.g. pure JavaScript clients, but hey implement this even more complicated thing instead!

Removes invalid characters from roster entries.

```bash
sudo prosodyctl mod_clean_roster
```