feat: harden the myep oauth2 client

src/Controller/Security/OAuth2Controller.php

@@ -22,10 +22,9 @@ class OAuth2Controller extends AbstractController
     {
         $this->denyUnlessFeatureIsActive();
 
-        $provider = $this->client->getProvider();
-        $url = $provider->getAuthorizationUrl();
-        $state = $provider->getState();
-        $request->getSession()->set('oauth2state', $state);
+        // the state and the PKCE verifier belong to the client, which is what consumes
+        // them again on the callback
+        $url = $this->client->createAuthorizationUrl($request);
 
         return $this->redirect($url);
     }