fix(auth): add PKCE to OpenID Connect login

Generate a per-login verifier, persist it in the Goth session, send an S256 challenge, and include the verifier during the token exchange when explicitly enabled.

Assisted-by: Codex:GPT-5

services/auth/source/oauth2/providers_openid.go

@@ -53,6 +53,9 @@ func (o *OpenIDProvider) CreateGothProvider(providerName, callbackURL string, so
 		// A single entry is sufficient because the admin explicitly chooses one claim (e.g. "oid" for Azure AD).
 		provider.UserIdClaims = []string{source.ExternalIDClaim}
 	}
+	if setting.OAuth2Client.EnableOpenIDConnectPKCE {
+		return newOpenIDConnectPKCEProvider(provider), nil
+	}
 	return provider, nil
 }