Support PKCE flow for OAuth apps

[jimafisk]

GitHub let's you authorize apps using OAuth but the supported grants require a server, making it difficult for clientside apps.

This requires Jamstack git-backed CMS projects like NetlifyCMS manage an intermediary server separately: https://www.netlifycms.org/docs/github-backend/ (same with TinaCMS and my project Plenti).

The Implicit Grant type was not allowed because of security issues, but Proof Key for Code Exchange (PKCE) should allow clientside apps to operate securely.

GitLab already implements this in their OAuth 2.0 identity provider API: https://docs.gitlab.com/ee/api/oauth2.html#authorization-code-with-proof-key-for-code-exchange-pkce

Thank you!

[jimafisk]

Another related discussion: https://github.com/orgs/community/discussions/40077

And documentation issue: github/docs#22270

[writeonlycode]

I would love see support for PKCE as well. It would make a huge difference for JAMStack websites.

[hickford]

PR to clarify that PKCE is not supported github/docs#24965