feat: PKCE support

config/locales/server.en.yml

@@ -15,6 +15,7 @@ en:
     openid_connect_overrides_email: "On every login, override the user's email using the openid-connect value. Works the same as the `auth_overrides_email` setting, but is specific to OpenID Connect logins."
     openid_connect_claims: "Explicitly define the claims for use with providers that don't pass data back based on scopes. (JSON)"
     openid_connect_match_by_email: "Use email address to match OpenID Connect authentications to existing Discourse user accounts."
+    openid_connect_use_pkce: "Enable Proof Key for Code Exchange (PKCE) for OpenID Connect authentication."
   login:
     omniauth_error:
       openid_connect_discovery_error: Unable to fetch configuration from identity provider. Please try again.

config/settings.yml

@@ -36,5 +36,4 @@ discourse_openid_connect:
   openid_connect_match_by_email:
     default: true
   openid_connect_use_pkce:
-    default: true
-    client: true
+    default: false

plugin.rb

@@ -8,7 +8,6 @@
 # url: https://github.com/discourse/discourse-openid-connect
 
 enabled_site_setting :openid_connect_enabled
-enabled_site_setting :openid_connect_use_pkce
 
 require_relative "lib/openid_connect_faraday_formatter"
 require_relative "lib/omniauth_open_id_connect"