fix: implement OAuth CSRF protection with state validation

[hrntknr]

Summary

Implements OAuth CSRF protection by adding proper state validation to prevent OAuth CSRF attacks. This addresses a high-severity security vulnerability where both OAuth providers used hardcoded static state values and lacked state validation in callback handlers.

Type of Change

• fix: A bug fix

Related Issues

Fixes #27

[Copilot]

Pull Request Overview

This PR implements OAuth CSRF protection by adding proper state validation to prevent OAuth CSRF attacks. The changes replace hardcoded static state values with randomly generated states and add validation in callback handlers.

• Adds a new utility function to generate cryptographically secure random OAuth state values
• Updates OAuth provider interfaces to accept and validate state parameters
• Implements state storage in session and validation during OAuth callbacks

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
pkg/utils/main.go	Adds GenerateState() function to create random OAuth state values
pkg/auth/main.go	Updates Provider interface and implements state generation/validation in OAuth flow
pkg/auth/google.go	Updates Google OAuth provider to use dynamic state and validate it during exchange
pkg/auth/github.go	Updates GitHub OAuth provider to use dynamic state and validate it during exchange

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}