Add nonce support to the OIDC authentication flow

[scweber-cisco]

Summary

Adds support for the OIDC nonce, which the Duo OIDC Auth API has accepted for some time but this
client had no way to send. Client.cs and Utils.cs both carried // TODO comments for it, and
IdToken.Nonce existed but was never populated, so a caller could not use the nonce as a replay
defense.

The nonce is sent as a claim in the authentication request JWT, echoed back by Duo as an id_token
claim, and compared by the client. Bounds are the 16–1024 characters the
API docs specify.

API

Every new entry point is an overload, so existing callers are untouched and the nonce stays opt-in:

string nonce = Client.GenerateNonce();                                  // also GenerateNonce(length)
string authUri = client.GenerateAuthUri(username, state, nonce);
IdToken token = await client.ExchangeAuthorizationCodeFor2faResult(code, username, nonce);

ExchangeAuthorizationCodeForSamlResponse gained the same 3-argument overload. The 2-argument
overloads omit the claim entirely rather than sending an empty one, and skip the check on the way
back; the 3-argument overloads validate the nonce up front and reject a mismatch with
DuoException.

All three nonce-aware entry points use the same shape: thin public overloads over a private core
taking a requireNonce flag. The 2-argument form cannot simply delegate to the 3-argument form,
because that one validates the nonce and would reject the null every existing caller effectively
passes.

Duo omits the claim when no nonce was sent, so an absent claim deserializes to null rather than
"", and comparison is StringComparison.Ordinal because a nonce is opaque.

Note that the public overloads are deliberately not async — they only hand off to the private
async core, which is what keeps an invalid nonce arriving as a faulted Task rather than as a throw
at the call site. This is not a signature change: the emitted IL is still
Task<IdToken>/Task<string>, so callers await exactly as before.

SAML failures now report their cause

ExchangeAuthorizationCodeForSamlResponse wrapped everything from token validation in
"Error while retrieveing saml response", so a username mismatch — and now a nonce mismatch —
reached the caller as a generic message with the real reason demoted to an inner exception. The Id
Token flow has always reported those directly; the SAML flow now matches it.

The catch is removed rather than narrowed to catch (DuoException) { throw; }, because it could
not fire for anything else: ValidateIdTokenFromResponse only ever throws DuoException, having
already wrapped parse failures itself, and SamlResponse is a plain auto-property.

This changes the message text on an existing failure path, so it is worth a look even though no
signature moves.

Test coverage

160 tests pass. New coverage: nonce generation and its bounds, the claim's presence and absence in
the request JWT, decoding it out of the id_token, and the exchange path for match, mismatch,
empty, null, a claim missing from the response, and an unexpected claim arriving when none was
requested — for both the token and SAML flows. The documented 16/1024 bounds are additionally
asserted as literals, so changing the client's constants cannot silently drift from the API
contract.

Two of those deserve calling out:

• The nonce-mismatch tests hold the returned Task without awaiting it. Awaiting on the line that
  makes the call collapses the two moments a Task-returning method can fail, and so cannot tell a
  synchronous throw from a faulted Task. Hoisting ValidateNonce out of the private core to fail
  fast would break callers who start the exchange and await it later, or who pass it to
  Task.WhenAll; these tests fail if that happens.
• A mismatch test has to use a wrong nonce that is still at least 16 characters, or validation
  rejects it on length and the comparison against the value Duo echoed back never runs.

Two unrelated fixes carried along

Neither has anything to do with the nonce; one is in the test suite, the other in the example app.
Each is a separate commit:

• Cert pinning tests. All 12 TestCertPinning tests failed on macOS. The embedded certificates
  have since expired and their OCSP responder now answers unauthorized for those serials, which
  surfaces as RevocationStatusUnknown; revocation is always checked against now, not against
  ChainPolicy.VerificationTime. Because CertificatePinnerFactory rejects any chain with a
  non-NoError status before comparing SPKI hashes, the hash comparison these tests exist to
  verify was never actually running. Setting RevocationMode = NoCheck restores that coverage
  (these tests cover pinning, not revocation) and drops suite time from ~1–2s to 116ms.

• Callback page readability. The <pre> was tagged class="language.json"; the dot makes that
  two classes, so the stylesheet's pre.language-json rule never matched. Fixing that alone was not
  enough: .content sets align-items: center, which sized the block to its widest line, and once
  that exceeded the window the start of every line landed at a negative offset where a browser will
  not scroll. At a 600px viewport the left edge sat at -38px, cutting off the opening brace and each
  key's leading quote. Verified before and after at narrow and wide viewports.

Not included

No version bump and no root README changes — those seemed like release decisions rather than part of
this change.

🤖 Generated with Claude Code