Provide a combinator for Protect that is required

[joneshf]

servant-oidc/src/OAuth2/Protect.hs

Lines 14 to 19 in 5766f51

	-- | A combinator for marking an endpoint as requiring OAuth2 authorization.
	--
	-- TODO: Because this combinator uses `Header` directly, clients using it will
	-- have to pass a `Maybe Authorization`. We should see if we can make a custom
	-- combinator that just takes an `Authorization`.
	type Protect = Header "Authorization" Authorization

One option is to use a different combinator altogether.

Another option is to update servant to at least version 0.13. It changed the type of headers. If we specify that it's a Header' '[Strict] "Authorization" Authorization, it ought to make it required for the API.