Enhance login security with CSRF protection and host validation

[uji]

Summary

This PR improves the security of the login flow by adding CSRF protection via state parameter validation and implementing host validation for the OAuth callback handler.

Key Changes

• CSRF Protection: Generate a random state parameter and validate it on callback using constant-time comparison to prevent CSRF attacks
• Host Validation: Restrict callback handler to only accept requests from 127.0.0.1 or localhost to prevent open redirect vulnerabilities
• Input Validation: Add explicit validation for the authorization code parameter to ensure it's present before processing
• Code Refactoring: Extract query parameters into a variable for cleaner code and improved readability

Implementation Details

• Uses crypto/subtle.ConstantTimeCompare() for timing-attack-resistant state comparison
• Validates the request host by splitting the Host header and checking against allowed localhost addresses
• Returns appropriate HTTP error responses (400 Bad Request) for security violations
• Maintains backward compatibility with existing OAuth flow while adding security layers