docs: add explanation section on how subclasses override functions called from the non-overridden authenticate function

[consideRatio]

The OAuthenticator.authenticate function is not supposed to be overridden, instead the subclasses are to override functions introduced in this project and called from the OAuthenticator.authenticate and check_allowed which is introduced in the Authenticator and overridden by OAuthenticator, and supposed to be overridden again by subclasses.

This section would be relevant to have if writing a tutorial on how to write a custom authenticator.

[kellyrowland]

+1, this would be really useful to have explained in the docs.

[epeters3]

Does https://oauthenticator.readthedocs.io/en/latest/how-to/writing-an-oauthenticator.html#writing-your-own-oauthenticator-class serve this purpose? Is it up to date?