fix: validate OAuth state before token exchange

[ryanduguid]

Summary

• validate a supplied OAuth callback state before the authorisation-code exchange
• prevent a mismatched callback from making a token request or overwriting the current token set
• return a static mismatch error that exposes neither the expected nonce nor attacker-supplied state
• add regression coverage for mismatched, matching and legacy no-state callback paths

This preserves the SDK's existing optional-state compatibility: callers that do not configure state continue to work. It makes the existing configured-state protection effective before the mutating token exchange occurs.

Validation

• Ruby 3.2 syntax checks for the implementation and focused spec
• git diff --check

The full RSpec suite could not run locally because this Windows environment lacks MSYS2/native gem build support. The focused spec retains explicit no-token-request and no-token-mutation assertions, and now also proves that neither synthetic state value appears in the error.