Upgrade oauth2 gem to v 2.0.9

* I added a minimum version of `2.0.6` because the next move will be to
  un-vendor `omniauth-google-oauth2` and use the latest version instead,
  which specifies `2.0.6` as the minimum version: https://github.com/zquestz/omniauth-google-oauth2/pull/429/files
* CHANGELOG shows mostly bug fixes and test coverage improvements
  between these versions: https://gitlab.com/oauth-xx/oauth2/-/blob/main/CHANGELOG.md
* Diff is noisy due to lots of docs changes: https://my.diffend.io/gems/oauth2/2.0.3/2.0.9