Roundcube 1.7 has it built-in https://github.com/roundcube/roundcubemail/blob/2e66510e2c4cf734a016befb02d96cef6bac12d4/program/include/rcmail_oauth.php#L1236. It also has support for "logout in cockpit should destroy OAuth tokens and client sessions" action (backchannel) https://github.com/roundcube/roundcubemail/blob/master/program/actions/login/oauth_backchannel.php.

I worked a bit on this before my vacation. Here's the code: https://git.kolab.org/D5891. I think it in general worked with Roundcube 1.7.