appview/oauth: verify "iss" parameter in auth response

From https://datatracker.ietf.org/doc/html/rfc9207#section-2.4 :

"Clients MUST [...] compare the result to the issuer identifier of the
authorization server where the authorization request was sent to. [...]
If the value does not match the expected issuer identifier, clients MUST
reject the authorization response and MUST NOT proceed with the
authorization grant."

Signed-off-by: Mike P <[e-mail]>

appview/oauth/handler/handler.go

···
 		return
 	}
 
+	if iss != oauthRequest.AuthserverIss {
+		log.Println("mismatched iss:", iss, "!=", oauthRequest.AuthserverIss, "for state:", state)
+		o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.")
+		return
+	}
+
 	self := o.oauth.ClientMetadata()
 
 	oauthClient, err := client.NewClient(