bug(oidc): short static request state nonce

Hi!

I have noticed that the nonce used in the OIDC authentication flow is a [short static string](https://github.com/francoismichel/ssh3/blob/5b4b242db02a5cfbb9ebf9dfc5aad2c32e10f245/auth/oidc/openid_connect.go#L92). This poses a security issue as these state nonces are intended to protect against CSRF attacks.

My current solution is to use the URL and the current time to generate a hash.

```go
h := sha256.New()
h.Write([]byte(fmt.Sprintf("%d", time.Now().UnixMilli())))
state := hex.EncodeToString(h.Sum([]byte(secretUrl)))
```

I do know that it isn't a great solution as the URL is in the request and the time is a monotonically incrementing counter, so I'm open to suggestions on how to improve this solution. Any suggestions?