docs: fix state parameter type documentation to match implementation

[nicknisi]

Summary

Fixes #326

The state parameter in getSignInUrl/getSignUpUrl is implemented as a string (matching OAuth 2.0 RFC 6749 specification), but the documentation showed examples using object literals without JSON serialization. This created a mismatch between what the docs promised and what actually works.

Changes

Updated all documentation examples to show explicit serialization:

1. Type documentation (line 141): Changed from Record<string, any> | undefined to string | undefined with parsing note
2. Early callback example (lines 103-105): Added JSON.parse(state) before accessing properties
3. Inline sign-in example (lines 227-232): Added JSON.stringify() around state object
4. Full "Passing Custom State" section (lines 405-445):
   • Updated intro to explain state is a string per OAuth spec
   • Added JSON.stringify() to all examples
   • Added JSON.parse() with null checks in callbacks
   • Added RFC 6749 reference explaining why serialization is manual

Why This Approach

The implementation correctly follows OAuth 2.0 RFC 6749, which defines state as an "opaque string". Keeping it as a string gives users control over serialization format (JSON, base64, encrypted tokens, etc.) and matches the WorkOS SDK interface.