chore(hybrid-cloud): Delegate pipeline redis store to propagate customer domain

[dashed]

In #38970, I had updated an OAuth2 provider implementation such that we do per-request customization by dynamically update the callback URL based on if a subdomain is present (e.g. sentry.sentry.io)

The OAuth2 spec on redirect URIs suggests that request-specific data in the callback URL be delegated to the "state" parameter.

I've undid the per-request callback URL changes added in #38970, and instead delegated to the pipeline redis store (using "state" parameter) to propagate any customer domain information.

The request flow for customer domains should look like this:

1. Go to https://orgslug.sentry.io
2. Click on social media button: https://sentry.io/identity/login/google/?referrer=login
3. Create unique state parameter and store orgslug customer domain in pipeline redis store.
4. Redirect to https://accounts.google.com/o/oauth2/auth
5. Perform OAuth2 authorization flow.
6. Redirect back to https://sentry.io/auth/sso/
7. Authorization code token exchange.
8. Retrieve orgslug customer domain from pipeline redis store, and redirect user to https://orgslug.sentry.io/auth/login
9. Redirect to https://orgslug.sentry.o/organizations/orgslug/issues/ (this will be an orgless slug in the future)

[markstory]

Looks good to me. Would be good to get someone from enterprise/ecosystem who is more familiar with our oauth implementation to also take a look

[markstory]

Should a user start and SSO flow, leave the tab open with oauth dance incomplete and then open a second tab, not complete that sso, and then go back and complete the first SSO flow they could end up at the wrong place.

In practice that is unlikely to matter as they should have access to both orgs that they started SSO on.

[dashed]

@markstory Wouldn't the first SSO fail if the state attributed was regenerated on the second tab? We compare the state values here when the user comes back to Sentry from the authentication provider

sentry/src/sentry/auth/providers/oauth2.py

Lines 105 to 106 in 8d9f92f

	if state != helper.fetch_state("state"):
	return helper.error(ERR_INVALID_STATE)

[dashed]

I do agree in practice it shouldn't matter.

[maxiuyuan]

lgtm, if ur cautious i would ask @RyanSkonnord to take a look as well

[evanpurkhiser]

If you need more help looking at this in the future. I wrote all of the pipeline and oauth stuff