support PKCE verification

[randName]

I was looking at the draft FAPI 2.0 specs and it mentions that PKCE will be enforced

I was also looking at an existing OIDC provider library and wondering if we should just leverage on that instead, since Singpass seems mostly spec compliant now and is moving towards that anyway

[cflee]

Looking at that draft, there are a bunch of other breaking changes (PAR, DPoP, ID token format change, userinfo response format change, ...) bundled together in this revision. I think we should consider treating this a major API version bump and implement it as a new endpoint, instead of modifying the current endpoint piecemeal.