Feature Request: Add optional PKCE support for OAuth2 / SSO Authentication

Description

Currently, the OAuth2 authentication module in Cortex supports the standard Authorization Code flow. However, many modern Identity Providers (IdPs) now strictly require or strongly recommend using PKCE (Proof Key for Code Exchange) for enhanced security.

Without PKCE support, integrating Cortex with these modern SSO environments can be problematic or completely blocked by strict enterprise security policies.

Proposed Solution

I propose adding PKCE support to the existing OAuth2 flow in Cortex, while keeping it 100% backward compatible for existing installations.

The implementation would include:

1. Adding a new configuration boolean parameter auth.oauth2.pkce (defaulting to false) for Cortex application.conf.
2. If enabled, dynamically generating a code_verifier and its hashed code_challenge (S256).
3. Appending the code_challenge to the initial authorization URL.
4. Retrieving the code_verifier from the session and sending it in the payload during the final token exchange request.

Alternatives Considered

Leaving the implementation as-is forces administrators to lower their IdP security requirements. Forcing PKCE for everyone might break integrations with older IdPs that do not tolerate unknown parameters. Making it configurable solves both issues.

Start at Cortex's OAuth2 authentication module and the application.conf configuration entry point; trace the authorization URL, session handling, and final token exchange. Done means an optional auth.oauth2.pkce setting preserves the existing default flow while adding S256 verifier and challenge handling when enabled.