Secure and modernize social login providers

[seakchiew]

Summary

• replaces hand-rolled Facebook/Google OAuth and legacy Twitter OAuth 1.0a with provider-specific authorization-code flows
• adds Facebook, Google, X, and LinkedIn support with session-bound state, PKCE where supported, fixed HTTPS endpoints, and sanitized provider failures
• removes silent email account linking and adds CSRF-protected explicit linking from an authenticated website-user session
• uses Preside's normal login(..., skipPasswordCheck=true) path so active-user checks, login recording, visitor-action promotion, and session rotation apply
• adds provider configuration, LinkedIn UI, namespaced social identities, regression specs, a security audit, and complete setup/verification documentation

Security controls

• one-time callback state with a ten-minute lifetime and concurrent flows keyed by state
• same-origin post-login redirects with backslash, user-info, control-character, host, scheme, and port validation
• no provider access-token persistence or token-bearing query strings
• conditional account-link updates and unique (type, social_id) identities
• explicit linking requires a CSRF-protected POST and the same fully authenticated user before and after OAuth
• provider identities without verified email use unique non-deliverable placeholders until local verification
• disabled or incomplete providers fail closed

Verification

• TestBox 7.0.0 on Lucee 6.2.7.16: 4 specs passed, 0 failed/errors
• SocialAuthService.cfc and handlers/Login.cfc parsed successfully on Lucee 6.2.7.16
• system configuration XML and manifest JSON parsed successfully
• git diff --check
• live provider testing requires a host Preside application and provider sandbox credentials; the exact matrix is documented in README.md

Upgrade notes

• Twitter4j and OAuth 1.0a credentials are no longer supported
• run Preside database synchronization after upgrade
• configure new X OAuth 2.0 client credentials before enabling X login