Add optional PKCE support for OAuth2

[EnzoCyberSec]

Description

This Pull Request is about adding PKCE support to the OAuth2 authentication flow. We talked about this in the issue.
Nowadays Identity Providers are starting to require PKCE to stop authorization code interception attacks. This new feature makes sure Cortex can work well with these secure Single Sign-On environments.
To make sure everything works with the system this feature is turned off by default. You can turn it on by changing the application.conf file.

Changes made

• Configuration: I added a flag to OAuth2Config that you can find in auth.oauth2.pkce. This flag is set to false by default.

• Authorization Request: If pkce is turned on the code makes a code_verifier. Stores it in the session. It also adds code_challenge and code_challenge_method=S256 to the Single Sign-On URI.

• Token Request: If there is a code_verifier in the session it gets added to the POST payload so we can get the access token.

How to use

Administrators just need to add this line to their application.conf file inside the block:

pkce = true

Related Issue

This resolves issue #493