fix(auth): add PKCE to OpenID Connect login

Generate a per-login verifier, persist it in the Goth session, send an S256 challenge, and include the verifier during the token exchange when explicitly enabled.

Assisted-by: Codex:GPT-5

services/auth/source/oauth2/providers.go

@@ -20,7 +20,6 @@ import (
 	"gitea.dev/modules/setting"
 
 	"github.com/markbates/goth"
-	"github.com/markbates/goth/providers/openidConnect"
 )
 
 // Provider is an interface for describing a single OAuth2 provider
@@ -210,7 +209,7 @@ func GetOIDCEndSessionEndpoint(providerName string) string {
 		return ""
 	}
 
-	oidcProvider, ok := provider.(*openidConnect.Provider)
+	oidcProvider, ok := asOpenIDConnectProvider(provider)
 	if !ok || oidcProvider.OpenIDConfig == nil {
 		return ""
 	}