fix(lms): url encode for iframe passthrough

[stephenliang]

This change URL encodes the state and nonce parameters. Since these parameters are used for redirects or window opens, the encoding is appropriate to ensure the values are passed through to the next page correctly.

Links

Testing story

1. Ran adhoc schoology instance
2. Tested launching schoology to Code.org

Deployment strategy

Follow-up work

Privacy

Security

Caching

PR Checklist:

• Tests provide adequate coverage
• Privacy and Security impacts have been assessed
• Code is well-commented
• New features are translatable or updates will not break translations
• Relevant documentation has been added or updated
• User impact is well-understood and desirable
• Pull Request is labeled appropriately
• Follow-up work items (including potential tech debt) are tracked and linked

[carl-codeorg]

LGTM. Not sure if it is any better, but there's also the URI::encode_www_form method that can handle the whole params object without calling url_encode individually for each file.

[nicklathe]

LGTM, nice catch.