Add support for PKCE in oauth2

[julien-nc]

• Resolves: Implement OAUTH2 Authorization code with PKCE #12881

Summary

• Support optional code_challenge and code_challenge_method params in the authorize endpoint
• Implement PKCE support as described in the RFC
• When using PKCE, only allow the S256 method (do no support plain)
• Fix preservation of the query params and fragments in the redirect URL

TODO

• test with a real client
• adjust server documentation

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI