Deactivate body_hash-checking when Inpustream isn't installed

When I removed the dependency on the Inpustream module I didn't deactivate the oauth_body_hash-checking - instead I switched it to use PHP:s built in inputstream. Since PHP:s built in inputstream can only be read once that isn't compatible with Services if it also removed its dependency on Inputstream: #1017036: Make Inputstream optional for REST Server

Since oauth_body_hash is an OAuth extension (specification) and we don't enforce clients to include it (since most client libraries probably doesn't support it) I think the correct solution would be to just not validate the hash if the Inpustream module hasn't been installed. Site owners are then free to install the Inputstream module if they want to offer OAuth clients extra security.

Patch will come.