Add OIDC PKCE functionality

[ssddanbrown]

Related to #4734.

Todo

• Check full implementation and library against RFC spec.
• Cover with PHPUnit testing.
• Auth system checks (Check each with and without enforcement for post/after compatibility):
  • Jumpcloud
    • Works fine, Could not force PKCE, fails when invalid.
  • Okta
    • Works fine, allows forcing PKCE. Fails in expected cases of invalid/missing value, including invalid when not enforced.
  • Auth0
    • Could not find option to force PKCE. Does fail with invalid PKCE in auth code request.
  • Keycloak
    • Works fine, allows forcing PKCE (via specifying method) and fails without, and invalid when not enforced.
  • Authentik
    • Could not find easy option to force PKCE, but does fail with invalid PKCE.
  • Azure
    • Could not find option to force PKCE, but does fail with invalid PKCE.

Docs Updates

• Update OIDC guidance to indicate support of PKCE, and advise enforcement where possible for extra security.
• Update advisory to advise enforcement? Probably a good idea.