add nonce parameter to OIDC flow

[bobcallaway]

Summary:

This change hardens the OIDC authentication process by implementing a cryptographically secure nonce (number used once) in the WebOidcClient.

Key Changes:

• Nonce Generation: Introduces a generateNonce() method that creates a random, URL-safe string using SecureRandom.
• Request Binding: Updates the authorization flow to include this nonce in the initial authorization request URL.
• Validation: Adds strict validation logic to verify that the nonce claim in the returned ID token matches the original nonce sent by the client.
• Testing: Adds WebOidcClientNonceTest to verify that tokens with correct nonces are accepted and tokens with mismatched or missing nonces are rejected.

Security Benefit:

This mechanism is a critical defense against Replay Attacks. By binding the ID token to the specific client request that initiated it, we ensure that an attacker cannot capture a valid ID token from a previous session and "replay" it to impersonate a user. If the nonces do not match, the token is immediately rejected.

[loosebazooka]

looks fine, gonna run some tests locally just to double check the web flow still works.

[loosebazooka]

ignore the example test failures. also please run ./gradlew spApp to apply formatting

[loosebazooka]

yeah locally weboidc seems to pass with google and github accounts.