Add PKCE support for OIDC

[CEbbinghaus]

Most OIDC clients support PKCE (rfc7636) for the OIDC authentication. It not only allows for secret-less auth (which would be required if we wanted to authenticate the client application directly) but also strengthens the auth provided by the server.

Almost every single modern ODIC Provider supports PKCE and some even enforce it as a standard (such as kanidm) so there is really no downside, only additional security