Enable state key on generic oauth2

[Sleuth56]

This PR enables the state key on the generic oauth2 requests. The state key is more secure and is required by a lot of oauth2 providers such as Authelia. https://www.rfc-editor.org/rfc/rfc6819#section-4.4.1.8

A working config for Authelia. (What I used to test this patch)

- id: Wikijs # this should be changed to something more secure
  description: Wikijs SSO
  secret: '' # Long randomly generated string
  public: false
  authorization_policy: one_factor
  audience: []
  scopes:
    - openid
    - profile
    - email
  redirect_uris:
    - https://wiki.example.com/login/{UNIQUE_ID}/callback # Copy this from the bottom of the oauth2 setup in wikijs
  userinfo_signing_algorithm: none
  grant_types:
    - authorization_code

If you are using Authelia's file database

user:
  disabled: false
  displayname: "User"
  display_name: "User"
  password: ""
  email: user@example.com
  groups:
    - owner
    - user