OIDC Authentication not work

*Description*:
I configured OIDC OAuth according to the documentation:
https://gateway.envoyproxy.io/v1.8/tasks/security/oidc/

```apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: trust-forwarded-headers
namespace: envoy-gateway-system
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: eg
clientIPDetection:
xForwardedFor:
numTrustedHops: 1
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: app
namespace: app
spec:
oidc:
clientID: app.com
clientSecret:
group: ''
kind: Secret
name: keycloak-secret
cookieDomain: app.com
logoutPath: /logout
provider:
authorizationEndpoint: https://keycloak.com/auth/realms/app/protocol/openid-connect/auth
backendSettings: {}
issuer: https://keycloak.com/auth/realms/app
tokenEndpoint: >-
https://keycloak.com/auth/realms/app/protocol/openid-connect/token
redirectURL: https://app.com/oauth2/callback
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: app
```

When I open [app.com](https://app.com/), I'm redirected to [keycloak.com](https://keycloak.com/) for authorization. After authorization, I'm redirected to the callback URL where I get a 502 error.

If I refresh the page, I get a 401 error: "OAuth flow failed."

```
2026-05-15T14:29:38.447808524+03:00 [2026-05-15 11:29:38.447][7][warning][oauth2] [source/extensions/filters/http/oauth2/filter.cc:1433] [Tags: "ConnectionId":"2542","StreamId":"3645030199099311061"] Responding with 401 Unauthorized. Cause: CSRF token validation failed
```

The correct URL, csrf_token, and flow_id are being passed in the state parameter.

*Environment*:
kubernetes 1.34.3
eg 1.8.0
envoy envoy:distroless-v1.38.0
demonset 2 replica

*Logs*:
```
2026-05-15T14:29:38.447808524+03:00 [2026-05-15 11:29:38.447][7][warning][oauth2] [source/extensions/filters/http/oauth2/filter.cc:1433] [Tags: "ConnectionId":"2542","StreamId":"3645030199099311061"] Responding with 401 Unauthorized. Cause: CSRF token validation failed
```