UX: Improve error handling for common OmniAuth exceptions (#7991)

This displays more useful messages for the most common issues we see:
- CSRF (when the user switches browser)
- Invalid IAT (when the server clock is wrong)
- OAuth::Unauthorized for OAuth1 providers, when the credentials are incorrect

This commit also stops earlier for disabled authenticators. Now we stop at the request phase, rather than the callback phase.

lib/csrf_token_verifier.rb

@@ -2,6 +2,8 @@
 
 # Provides a way to check a CSRF token outside of a controller
 class CSRFTokenVerifier
+  class InvalidCSRFToken < StandardError; end
+
   include ActiveSupport::Configurable
   include ActionController::RequestForgeryProtection
 
@@ -17,7 +19,7 @@ class CSRFTokenVerifier
     @request = ActionDispatch::Request.new(env.dup)
 
     unless verified_request?
-      raise ActionController::InvalidAuthenticityToken
+      raise InvalidCSRFToken
     end
   end