[Spike] How to migrate apps using loopback-component-oauth2

[bajtos]

This is a follow-up for #3718 and #3922.

Write content for docs/site/migration/auth/oauth2.md, explain how to migrate LB3 applications using loopback-component-oauth2 to LB4.

Acceptance criteria

• Migration guide describing manual steps

[bajtos]

I think this story will require a spike first.

[emonddr]

This is for server side.

We don't intend on supporting our own oauth2 server module.

• Point them to existing infrastructure (social website passport modules)
• need to document how they can use these social website ones. We need to describe the LB4 authentication and authorization steps to enable the usage of access tokens from external oauth2 providers.