fix: Replace insecure Google ID token decode with OIDC verification and nonce

[MP-Tool]

Google Provider: Security Fix — Replace Unsafe Token Decode with OIDC Verification

Why

The previous Google login flow used insecure_decode to read the ID token returned by Google. This function only base64-decodes the JWT payload — it does not verify the signature, issuer, audience, or expiry. Any tampered or forged token would have been accepted without detection.

The fix replaces this with a standards-compliant OIDC Authorization Code Flow: Google's well-known endpoint is used for discovery, the authorization code is exchanged for a token response via the OIDC client, and the ID token is verified against Google's JWKS (signature, issuer, audience, expiry). A nonce is introduced in the authorization request and verified against the token, preventing replay attacks.

What changed

Replaced insecure_decode with full OIDC ID token verification
The Google flow now uses openidconnect for discovery, code exchange, and ID token verification. The verified claims (sub, email, picture) are extracted from the validated token.

Nonce added to the authorization request and session
A cryptographically random nonce is generated per login, included in the authorization URL, stored in the session, and verified against the returned ID token. This closes the replay attack vector.

get_google_user(code, nonce) → GoogleUser replaces the old two-step pattern
Discovery, code exchange, and ID token verification happen in a single method with one shared HTTP client, keeping the implementation clean and the call site simple.