Issues with Google OAuth Provider when logging in via my frontend application - "Application state check failed."

**Describe your question/**
I've set up a basic web application which has a "Sign in with Google" button. That button then uses the OAuth Consent screen and an implicit grant to login via a test client I set up in my Google account.
I've added a Google OAuth social sign on to my local Authentik setup by following[the guide on the Authentik docs website](https://docs.goauthentik.io/docs/users-sources/sources/social-logins/google/cloud/) but I'm seeing an error "Application state check failed" after the callback is hit.

It sounds like the `authentik_session` cookie is not being correctly set via the callback URL (using the Google icon via the Authentik login screen enrolls me as a user, but tries and fails to log into Authentik's interface when using the default flows).

**Relevant info**
Microsoft Edge - Version 136.0.3240.92 (Official build) (64-bit)
Firefox - Version 138.0.4 (64-bit)
Docker for Windows - Version v4.41.2

**Logs**
Server Logs:
```
{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "No state stored in the session.", "host": "localhost:9000", "level": "warning", "logger": "authentik.sources.oauth.clients.oauth2", "pid": 63, "request_id": "467bbfe61a9341bfa9f79380b3810caf", "schema_name": "public", "timestamp": "2025-05-26T18:35:26.789270"}

{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "Application state check failed.", "host": "localhost:9000", "level": "warning", "logger": "authentik.sources.oauth.clients.oauth2", "pid": 63, "request_id": "467bbfe61a9341bfa9f79380b3810caf", "schema_name": "public", "timestamp": "2025-05-26T18:35:26.789627"}

{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "Authentication Failure", "host": "localhost:9000", "level": "warning", "logger": "authentik.sources.oauth.views.callback", "pid": 63, "reason": "State check failed.", "request_id": "467bbfe61a9341bfa9f79380b3810caf", "schema_name": "public", "timestamp": "2025-05-26T18:35:26.789836"}

{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "/source/oauth/callback/google/", "host": "localhost:9000", "level": "info", "logger": "authentik.asgi", "method": "POST", "pid": 63, "remote": "172.19.0.1", "request_id": "467bbfe61a9341bfa9f79380b3810caf", "runtime": 28, "schema_name": "public", "scheme": "http", "status": 302, "timestamp": "2025-05-26T18:35:26.800985", "user": "", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0"}

{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "/flows/-/default/authentication/", "host": "localhost:9000", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 63, "remote": "172.19.0.1", "request_id": "e827b4cbd2504431a3a280c22085bd4c", "runtime": 24, "schema_name": "public", "scheme": "http", "status": 302, "timestamp": "2025-05-26T18:35:26.847172", "user": "", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0"}

{"auth_via": "unauthenticated", "domain_url": "localhost", "event": "/if/flow/default-authentication-flow/", "host": "localhost:9000", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 63, "remote": "172.19.0.1", "request_id": "47ffa0c0720345cd8dc4eae1867ea96c", "runtime": 34, "schema_name": "public", "scheme": "http", "status": 200, "timestamp": "2025-05-26T18:35:26.905380", "user": "", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0"}
```

- authentik version: 2025.4.1
- Deployment: docker-compose

**Additional context**

I'm experiencing an issue when using a Google provider after following the setup at https://docs.goauthentik.io/docs/users-sources/sources/social-logins/google/cloud/.

I'm running via Docker compose using version 2025.4.1 and initially I thought it was a Firefox tracker blocking issue, so I ran in Edge where I have a stock setup bar my password manager, and I also deleted the Redis volume which is part of my Docker compose stack just in case. No luck on either browser with the logs you see above being the same for both browsers (besides the user agent).

I added the scopes of `openid profile email` to the OAuth source, and the `http://localhost:9000/source/oauth/callback/google/` is a valid redirect from Google's end. Thereforre, the ID token is making its way back in the `POST http://localhost:9000/source/oauth/callback/google/` call as expected, yet I continue to see the "Welcome to Authentik" login screen, something I'd not expect if the Google ID token was correctly set on the Authentik requests, thereby allowing the email -> username mapping to kick in.

The line causing the error I see in the UI is [in the OAuth2 client Python file](https://github.com/goauthentik/authentik/blob/version/2025.4.1/authentik/sources/oauth/clients/oauth2.py#L90).

If I use the Google button on the Authentik login page it will detect me correctly and enroll me as a new user, but will show " Request has been denied. Interface can only be accessed by internal users". Bear in mind this is using the default flows and I suspect creating my own flow will resolve the error (by removing the log in to Authentik stage).