Handle race condition of state and code verifier

[sergiodxa]

Fix #67

When triggering multiple times the OAuth2 flow, each redirect to the authorization URL sets the same cookie with the state and codeVerifier values. This can cause a race condition where only the last one will work as the previous states and code verifiers will be overwritten by the last Set-Cookie header.

This PR implements a StateStore class that's used internally to keep track of multiple states and code verifiers.

The way it works is that every redirect to the authorization URL will now set a different cookie name, using the provided cookie name (or oauth2) as the prefix and appending a UUID (e.g. oauth2:b450faeb-1f67-461e-bf4d-004b6f0a6e55 or custom-name:b450faeb-1f67-461e-bf4d-004b6f0a6e55).

Then when the user is back on the application, the StateStore can read all of these cookies to get every state and code verifier, if the state in the URL matches one of the stored ones, it will then use the associated code verifier to get the tokens from the identity provider.

Because each state and code verifier is stored in a separate cookie, each one can expire individually, which allows using short max age of the cookies (the default is 5 minutes but it could probably be reduced to one or two safely).