Fix concurrent oidc login cookie overwrites

[lovasoa]

Split OIDC state cookie into two separate cookies to prevent race conditions during concurrent login flows.

Previously, a single sqlpage_oidc_state cookie was used to store both the nonce and the redirect URL. When multiple OIDC login flows were initiated simultaneously in the same browser, this cookie would be overwritten, leading to authentication failures and loss of the intended redirect target. This change introduces a sqlpage_oidc_nonce cookie for the nonce and a short-lived, state-specific sqlpage_oidc_state_{csrf_token} cookie for the redirect URL, ensuring each login flow maintains its unique state.

---

 

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}