When should you generate the code challenge for a `goth`/`gothic` PKCE OAuth flow?

Nobody has claimed this yet.

Normal PKCE authorization URL generation looks like:

```go
// Creates the initial authorization url with the state and code challenge.
// The state and code verifier are passed back alongside the URL here,
// these would be stored in sessions or HTTP only cookies, in memory, etc.
// Something to make sure that they stick around to verify the state and are able to
// send the code verifier along with the auth code request.
func AuthorizationURL(config *oauth2.Config) (*AuthURL, error) {
codeVerifier, verifierErr := RandomBytesInHex(32) // 64 character string here
if verifierErr != nil {
return nil, fmt.Errorf("could not create a code verifier: %v", verifierErr)
}
sha2 := sha256.New()
io.WriteString(sha2, codeVerifier)
codeChallenge := base64.RawURLEncoding.EncodeToString(sha2.Sum(nil))

state, stateErr := RandomBytesInHex(24)
if stateErr != nil {
return nil, fmt.Errorf("could not generate random state: %v", stateErr)
}

authUrl := config.AuthCodeURL(
state,
oauth2.SetAuthURLParam("code_challenge_method", "S256"),
oauth2.SetAuthURLParam("code_challenge", codeChallenge),
)

return &AuthURL{
URL: authUrl,
State: state,
CodeVerifier: codeVerifier,
}, nil
}
```

However, in `goth.Provider` only supports authorization url creation with a `state` (missing `code_challenge_method`, and `code_challenge`).

It's clear to me that certain `goth` providers ([Fitbit](https://github.com/markbates/goth/blob/master/providers/fitbit/fitbit.go), [Gitea OIDC](https://github.com/markbates/goth/pull/474), and [Zoom](https://github.com/markbates/goth/blob/492927988958a49753893bce51f9c972dce82929/providers/zoom/session.go#L43)) support PKCE, so it seems possible.

**So, in conclusion, I just don't understand how you're supposed to complete a PKCE OAuth flow with `goth` and `gothic` because of the issues I just described. I would love some pointers on how to do this (if possible)!**

In the meanwhile, I'm going to be writing my own PKCE implementation with `github.com/golang/oauth2` :(.

Start by reading goth.Provider's authorization URL interface and the PKCE-related implementations mentioned for Fitbit, Gitea OIDC, and Zoom. Trace how goth and gothic retain the state and verifier through the callback; done would be a clear supported flow or API for supplying the code challenge and verifier.

Written by the indexing model from the issue text.