Support OIDC form_post response mode

[sberyozkin]

Description

Some OIDC providers such as Apple OIDC (as discovered by @FroMage) use a form_post response mode when returning the authorization code to quarkus-oidc - so instead of including it as a query parameter in a GET redirect it will be form-posted, alongside state, to Quarkus with POST.

So this response mode should also be supported

Implementation ideas

Fallback to checking the form payload if the state verification has been done but no code has been found in a query string

[quarkus-bot]

/cc @pedroigor

[FroMage]

I already have a proto of this working. Needs config and tests though.

[sberyozkin]

We can tweak OIDC wiremock a bit to support the form_post as well, but,
Hmm... I've just realized the state is also posted and is state is not a query param we can't decide the post body can be read...i.e, how can quarkus-oidc figure out this POST is for quarkus-oidc only ? Perhaps, by analyzing the state cookie value and comparing the path stored there with the current request path.

[FroMage]

I've added preliminary support for this in FroMage@671c37c

I'm not sure this should require a configuration to turn it on or off, because this only happens when calling the OIDC callback endpoint, and we can just look at the method being used if it's GET or POST.

[FroMage]

@sberyozkin fixing this would be really nice.