Feature request: support PKCE for OAuth authorization code flow

Is your feature request related to a problem? Please describe.

PKCE ("Proof Key for Code Exchange") is an optional part of the OAuth authorization code flow. While primarily intended for mobile apps and single-page web applications, it may also be used to enhance the security of traditional server-side web applications.

Describe the solution you'd like

Let's add support for PKCE to UI server.

Describe alternatives you've considered

n/a

Additional context

The draft "OAuth 2.0 Security Best Current Practice" document has this to say:

For confidential clients, the use of PKCE [RFC7636] is RECOMMENDED, as it provides strong protection against misuse and injection of authorization codes as described in Section 4.5.3.1 and, as a side-effect, prevents CSRF even in the presence of strong attackers as described in Section 4.7.1.

(from https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.1.1-2.2)

The x/oauth2 library now supports PKCE (as of https://go-review.googlesource.com/c/oauth2/+/463979).
IdP support for PKCE should be indicated by the code_challenge_methods_supported property of the /.well-known/openid-configuration discovery endpoint.
RFC 7636 Proof Key for Code Exchange by OAuth Public Clients

Start by locating the UI server's OAuth authorization-code flow and its /.well-known/openid-configuration discovery handling. Review RFC 7636 and the referenced x/oauth2 PKCE support, including code_challenge_methods_supported. Done means the UI server supports PKCE for the flow and handles IdP capability information appropriately.