fix(ui): validate OIDC authorization nonce

[chris-dare-dev]

Description

Closes #6797

Cognito can add a nonce claim to the ID token during a federated login. Kargo did not send or retain a nonce and therefore asked oauth4webapi to expect no nonce, causing the first federated login to fail claim validation.

This change:

• generates and persists a nonce with the existing PKCE and state values;
• sends the nonce in the authorization request and validates it in the ID token;
• consumes one-time callback state and removes callback parameters before processing; and
• reports the OAuth error message, claim name, and error code without serializing claim values.

The PR is opened as a draft because #6797 currently has the blocking area/security label.

Checklist

Eligibility

• Linked to an existing issue with no blocking labels (kind/proposal, needs discussion, needs research, maintainer only, area/security, size/large, size/x-large, size/xx-large).
• Changes documentation only.
• Changes ten lines or fewer.

Quality

• Adds or updates corresponding tests.
• Adds or updates corresponding documentation.

AI Use Disclosure

This PR was written:

• By a human without AI assistance.
• By a human with AI assistance. A human has reviewed every line prior to opening the PR.
• By an AI with human supervision. A human has reviewed every line prior to opening the PR.
• Entirely by an AI. No human has reviewed this prior to opening the PR.

Sign-Off

All commits:

• Are signed off by their author (git commit -s) (required)
• Are cryptographically signed (git commit -S) (encouraged)

Verification

• pnpm exec vitest run src/features/auth/oidc-utils.test.ts
• pnpm exec eslint src/features/auth/oidc-login.tsx src/features/auth/oidc-utils.ts src/features/auth/oidc-utils.test.ts --max-warnings=0
• pnpm run typecheck
• pnpm run build

[netlify]

✅ Deploy Preview for docs-kargo-io ready!

Name	Link
🔨 Latest commit	d55a147
🔍 Latest deploy log	https://app.netlify.com/projects/docs-kargo-io/deploys/6aa35f2f6d64020008781e05
😎 Deploy Preview	https://deploy-preview-7186.docs.kargo.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[kargo-governance-bot]

Automated Policy Notice

This pull request has been converted to a draft because the linked issue (#6797) has not been unblocked for external contribution. Maintainers do not routinely review drafts.

The issue currently has the following blocking label(s): area/security

To move forward:

1. Wait for a maintainer to review the issue and remove any blocking labels
2. Ensure the implementation in this PR is consistent with discussion points in the linked issue
3. Mark the PR ready for review

See the Contributor Guide for full details.