aws-cognito: `oAuth.callbackUrls` of `UserPoolClient` should not have `http://example.com`

### Describe the bug

The property `oAuth.callbackUrls` of `UserPoolClient` should be mandatory when `flows.authorizationCodeGrant` or `flows.implicitCodeGrant` is`true` otherwise, the `oAuth.callbackUrls` results into `['http://example.com']`.
[](url)

### Expected Behavior

An error is thrown when `oAuth.callbackUrls` is empty but `flows.authorizationCodeGrant` or `flows.implicitCodeGrant` is`true`.

### Current Behavior

`oAuth.callbackUrls` results into `['http://example.com']`

### Reproduction Steps

```ts
declare const userPoolIdentityProviderOidc: UserPoolIdentityProviderOidc;
// 👇 code goes through
const userPoolClient = new UserPoolClient(this, 'UserPoolClient', {
userPool,
userPoolClientName: `${serviceName}-user-pool-client`,
generateSecret: true,
supportedIdentityProviders: [{
name: userPoolIdentityProviderOidc.providerName,
}],
authFlows: {
userPassword: true,
},
oAuth: {
flows: {
authorizationCodeGrant: true,
},
},
});
```

### Possible Solution

Either remove the default or put a guardrail or throw an error when `flows.authorizationCodeGrant` or `flows.implicitCodeGrant` is`true` and `oAuth.callbackUrls` is not set.

### Additional Information/Context

_No response_

### CDK CLI Version

2.110.0

### Framework Version

_No response_

### Node.js Version

18.15

### OS

macOS 14.1

### Language

TypeScript

### Language Version

5.2

### Other information

_No response_

Start at the TypeScript UserPoolClient entry point and trace how the oAuth configuration handles callbackUrls and authorizationCodeGrant or implicitCodeGrant. Reproduce the configuration from the report, then add coverage showing that an empty callback URL list produces an error instead of ['http://example.com'].

Written by the indexing model from the issue text.