/token endpoint should validate redirect_uri matches

Describe the bug
The /token endpoint doesn't check that the redirect_uri provided in the request matches the redirect_uri originally provided in the /authorize request, which is required by https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3.

redirect_uri: REQUIRED, if the "redirect_uri" parameter was included in the authorization request as described in Section 4.1.1, and their values MUST be identical.

This seems like a problem with the way the AuthProvider interface is designed - the only method the provider can expose is challengeForAuthorizationCode, so there's no way for the provider to tell the SDK what redirect_uri was originally provided. Fixing this will require a change to the interface (and the cleanest way to fix it is a breaking change), so we should probably fix this before too many integrations grow around the existing AuthProvider interface.

To Reproduce
Steps to reproduce the behavior:

1. Make an /authorize request
2. Make an /token request with a different redirect_uri; this returns a successful response.

Expected behavior
The /token request should return an HTTP 400 with error=invalid_grant (https://datatracker.ietf.org/doc/html/rfc6749#section-5.2).

Start by inspecting the AuthProvider interface and the /authorize and /token endpoint handlers. Trace how the redirect_uri from authorization is represented when the authorization code is created, then verify the token request can compare it and return HTTP 400 with invalid_grant on a mismatch. Add or update coverage for matching and different redirect_uri values.