Add support for PKCE in oauth2

[julien-nc]

• Resolves: Implement OAUTH2 Authorization code with PKCE #12881

Summary

• Support optional code_challenge and code_challenge_method params in the authorize endpoint
• Implement PKCE support as described in the RFC
• When using PKCE, only allow the S256 method (do no support plain)
• Fix preservation of the query params and fragments in the redirect URL

TODO

• test with a real client: This script was used for testing: pkce_test.sh . It takes the base URL, client ID and client secret as input, generates the code challenge, guides the user to browse the authorize page and log in, then takes the oauth code as input (the user gets it in the redirect URI) and performs a bunch of test requests (testing errors and successes).
• adjust server documentation

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI