fix: Add response_type + PKCE parameters to OAuth authorization endpoint

[talalryz]

What does this change do

Fixes OAuth 2.1 PKCE (Proof Key for Code Exchange) support in LiteLLM's MCP OAuth proxy.
Previously, the proxy did not forward PKCE parameters, causing OAuth flows with providers like
Google to fail when used with PKCE-compliant clients (such as Claude Code).

Changes Made

1. Authorization endpoint (/authorize):

   • Added support for code_challenge and code_challenge_method query parameters
   • Forwards PKCE parameters to upstream OAuth providers
   • Stores PKCE parameters and client redirect_uri in encrypted session state

2. Token endpoint (/token):

   • Added support for code_verifier form parameter
   • Forwards PKCE verifier to upstream OAuth provider for validation
   • Only includes non-null fields in token response to prevent validation errors

3. State management:

   • Enhanced state encryption to store PKCE parameters and client redirect URIs
   • Maintains OAuth session data throughout the authorization flow

4. Tests:

   • Added test_authorize_endpoint_forwards_pkce_parameters() to verify PKCE parameter forwarding
     in authorization
   • Added test_token_endpoint_forwards_code_verifier() to verify PKCE verifier forwarding in
     token exchange

Impact

• ✅ Google MCP OAuth now works with PKCE-compliant clients
• ✅ GitHub MCP OAuth continues to work (backward compatible)
• ✅ Any OAuth 2.1 provider with PKCE is now supported
• ✅ Non-PKCE OAuth flows remain unaffected

🤖 Generated with Claude Code

Relevant issues

Fixes #15684

Tested Locally -> screenshots

Step 1

Step 2

Step 3

Pre-Submission checklist

• I have Added testing in the
  tests/litellm/ directory, Adding
  at least 1 test is a hard requirement - see
  details
• I have added a screenshot of my new test passing locally
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem

Type

🐛 Bug Fix

[vercel]

Someone is attempting to deploy a commit to the CLERKIEAI Team on Vercel.

A member of the Team first needs to authorize it.

[CLAassistant]

All committers have signed the CLA.

[talalryz]

cc: @mubashir1osmani @krrishdholakia @ishaan-jaff please take a look

[krrishdholakia]

LGTM! Thank you for the fix @talalryz