Reject authorization codes on OAuth state mismatch

[drewrukin]

Problem

Swagger UI detects a state mismatch in the authorization-code callback but
only logs a warning. It still saves the returned code, deletes the original
state, and starts the token exchange.

This can attach a response from another or older OAuth request to the current
authorization flow, leading to login CSRF or authorization under the wrong
account, tenant, or OAuth configuration.

Fix

Validate the returned state before either authorization-code callback path.
This includes the normal path that stores a new code and the path where the
authorization object already contains a code.

On a mismatch, report an authorization error, close the redirect window, and
return immediately. Do not update the authorization object, delete the saved
state, invoke the callback, or start token exchange.

Valid authorization-code responses continue through the existing callback.
Implicit-flow responses keep their current behavior and still pass the state
validation result to the caller.

Result

After this change, an authorization response cannot cross from one OAuth
request into another. The original request state remains available after a
rejected response, and downstream code never receives or exchanges a code
that failed the state check.

Tests cover all supported authorization-code flow names, matching and
mismatched states, an existing authorization code, and the implicit flow.

Verification

mvn -pl gateway-openapi-ui -am -Dtest=OAuth2RedirectScriptTest -Dsurefire.failIfNoSpecifiedTests=false test