fix(oauth): reject plain PKCE method per OAuth 2.1 spec

[georgelzrc]

Problem

validatePKCEParams() in authorize.go accepts code_challenge_method=plain.
VerifyPKCEChallenge() in security/pkce.go verifies it by comparing
code_challenge == code_verifier with constant-time compare.

OAuth 2.1 (draft-ietf-oauth-v2-1-12, §4.1.1) explicitly removes support for plain:

"The plain code challenge method is not supported in OAuth 2.1."

Why it matters

With plain, code_challenge = code_verifier is sent unencrypted in the
authorization request URL (GET /oauth/authorize?code_challenge=<value>&...).

This URL routinely appears in:

• Server access logs
• Browser history
• Referer headers on the redirect to the client
• CDN and proxy logs

An attacker who can read any of those can immediately replay the authorization
code by supplying code_verifier = code_challenge in the token exchange,
defeating PKCE's proof-of-possession guarantee entirely.

With S256 this is impossible: code_challenge = BASE64URL(SHA256(code_verifier))
is a one-way transform.

Changes

• internal/api/oauthserver/authorize.go — validatePKCEParams(): reject any
  code_challenge_method other than S256 with a clear error message referencing
  the spec.
• internal/security/pkce.go — VerifyPKCEChallenge(): remove the plain
  case so it falls through to default returning PKCEInvalidCodeMethodError.
• internal/security/pkce_test.go: update all plain cases to expect errors.
• internal/api/oauthserver/authorize_test.go: add TestValidatePKCEParams_OAuth21
  covering S256 accepted, plain/PLAIN/rs256 rejected, and missing-param cases.

References

• https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-4.1.1
• RFC 7636 §7.2 — recommends S256 over plain even in OAuth 2.0