Enhance OAuth security and state validation

- Implemented stricter OAuth security measures, including CSRF protection via state parameter validation and redirect_uri checks.
- Updated OAuth models to support timezone-aware datetime comparisons, replacing deprecated `utcnow`.
- Enhanced logging for malformed Basic auth headers during token, introspect, and revoke requests.
- Added allowlist validation for OAuth provider domains to prevent open redirect attacks.
- Improved nonce validation for OpenID Connect tokens, ensuring token integrity during Google provider flows.
- Updated E2E and unit tests to cover new security features and expanded OAuth state handling scenarios.

frontend/src/app/[locale]/(auth)/auth/callback/[provider]/page.tsx

@@ -53,6 +53,18 @@ export default function OAuthCallbackPage() {
       return;
     }
 
+    // SECURITY: Validate state parameter against stored value (CSRF protection)
+    // This prevents cross-site request forgery attacks
+    const storedState = sessionStorage.getItem('oauth_state');
+    if (!storedState || storedState !== state) {
+      // Clean up stored state on mismatch
+      sessionStorage.removeItem('oauth_state');
+      sessionStorage.removeItem('oauth_mode');
+      sessionStorage.removeItem('oauth_provider');
+      setError(t('stateMismatch') || 'Invalid OAuth state. Please try again.');
+      return;
+    }
+
     hasProcessed.current = true;
 
     // Process the OAuth callback