authState callback not called if the return value is not assigned to a class member variable

Are you filing an issue about iOS 12?
Yes.

Describe the bug
If the authState function's return value is not assigned to a class member variable, the callback will not be called.

To Reproduce
Using code as below:

OIDAuthState.authState(byPresenting: request, presenting: self, callback: { (authState, error) in
            //handleError
            
            if let authState = authState {
                let authorizer = GTMAppAuthFetcherAuthorization(authState: authState)
                
                self.pickGmailLabels(authorizer: authorizer)
            }
})

The call-back is not called even though everything is correct. It will be called if we assign the result to some class member variable, e.g.

appDelegate.currentAuthorizationFlow = OIDAuthState.authState(byPresenting: request, presenting: self, callback: { (authState, error) in
            //handleError
            
            if let authState = authState {
                let authorizer = GTMAppAuthFetcherAuthorization(authState: authState)
                
                self.pickGmailLabels(authorizer: authorizer)
            }
})

Expected behavior
Callback will be called regardless of whether the result of authState is assigned or not. As per iOS-12 and above, we don't actually need to wire the callback in AppDelegate anymore.

Screenshots
nil

Smartphone (please complete the following information):

• Device: iPhone 11 simulator
• OS: ios14

Additional context
I managed to resolve the issue for the use case above, by removing the __weak from

__weak id<OIDExternalUserAgentSession> _session;

in OIDExternalUserAgentiOS.m

However, I am not familiar enough with Objective-C to know if this will create memory leaks.

This issue is also experienced in #197

Start with OIDExternalUserAgentiOS.m and inspect the weak _session declaration mentioned in the report. Reproduce the callback behavior with and without assigning the authState return value, then determine whether the session remains alive without introducing a memory leak. Done means the callback is reliably invoked in both cases with safe ownership behavior.