fix: use raw Basic auth for custom OIDC/OAuth token exchange

[rohanpatel2002]

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

Custom OIDC / OAuth2 providers exchange the authorization code via oauth2.Config.Exchange without setting Endpoint.AuthStyle. In that case golang.org/x/oauth2 uses auto-detect:

1. Attempt 1: Authorization: Basic with url.QueryEscape(client_id) / url.QueryEscape(client_secret)
2. On failure: retries as client_secret_post (credentials in the body)

Providers that expect a raw client secret in Basic auth (for example Epic Games, same as curl -u) reject Attempt 1 when the secret contains characters that QueryEscape rewrites (+, /, =, …). Attempt 2 then fails because those providers require an Authorization header. Callers only see the Attempt-2 error (e.g. “Authorization header may be invalid or not present”), which hides the real invalid_client_credentials failure.

Fixes #2623

What is the new behavior?

For Custom OIDC and Custom OAuth2 providers:

• Token exchange uses an explicit AuthStyleInHeader (no auto-detect / second attempt).
• A small HTTP transport rewrites the Basic header to the raw client id and secret before the request is sent (no QueryEscape).
• PKCE and other AuthCodeOptions still go through Exchange as before.

Unit tests assert a single token request, raw credentials on the wire for secrets containing +/ =, and that the first provider error is surfaced.

Additional context

This follows RFC 7617-style Basic auth (curl -u) rather than the library’s QueryEscape-in-header behavior, which is a known footgun for several IdPs. Built-in providers (Google, etc.) are unchanged. Happy to adjust if maintainers prefer an opt-in config flag instead of the default for custom providers. Thank you for reviewing.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.