fix(oauth2): escape authorize form values in login HTML

[unvalley]

Summary

• HTML-escape authorize query values before embedding them in login form hidden fields
• prevent reflected script or attribute injection via state, nonce, redirect_uri, and related fields
• add a unit test for escaped output

Testing

• cargo test test_generate_login_html_escapes_attribute_values
• cargo test test_authorization_code_flow