fix(oauth2): 修复 redirect_uri 校验绕过

[zhou-ai-bot]

Summary

• replace prefix-based redirect URI validation with URI component checks
• add hsweb.oauth2.redirect-uri-validation-mode to keep COMPATIBLE behavior by default and allow opt-in EXACT matching
• reject redirect URIs with fragment and bind authorization codes to the authorized redirect_uri during token exchange
• add regression tests for compatible matching, exact matching, and authorization code redirect URI binding

Testing

• mvn -pl hsweb-authorization/hsweb-authorization-oauth2 -am -Dtest=OAuth2ClientTest,DefaultAuthorizationCodeGranterRedirectUriTest -Dsurefire.failIfNoSpecifiedTests=false test

Notes

• redirect URIs with fragment are rejected because authorization code responses append parameters in the query string; if the registered callback contains #fragment, the returned code and state would end up after # and would not be sent to the server as standard query parameters
• mvn -pl hsweb-authorization/hsweb-authorization-oauth2 -am test is currently blocked by an unrelated existing failure in hsweb-datasource-api (DefaultSwitcherTest)

Closes #354