Add documentation for 3-legged oauth, including token endpoint

[jakedt]

We need to mention that you can swap a code for an access token at the following url, when using the authorization_code grant type: https://quay.io/oauth/access_token