feat(oauth): add PKCE to OAuth integrations

[sranka]

Closes #5394

Briefly describe your proposed changes:

OAuth integrations newly use OAuth PKCE (RFC7636) to provide a more secure OAuth token exchange. Google, Azure, Octa, Auth0, Gitlab (and more) integrations already support OAuth PKCE. PKCE enablement should have no effect on the communication with authorization servers that don't support it yet (such as Github, Bitbucket). PKCE can be eventually turned off with OAUTH_NO_PKCE=true environment variable.

Configuration Changes (to be documented)

• new option in chronograf cli: --oauth-no-pkce (or OAUTH_NO_PKCE environment variable) disables OAuth PKCE.

Implementation changes

• refactor OAuth implementation so that code exchange can be customized
• move existing implementation to CodeExchangeCSRF
• implement CodeExchange that use PKCE
• add OAUTH_NO_PKCE (bool) option to chronograf cmd, use it for all OAuth providers
• + a few housekeeping changes

• CHANGELOG.md updated with a link to the PR (not the Issue)
• Well-formatted commit messages
• Rebased/mergeable
• Tests pass