Add OAuth 2.1 authentication support

[EhabY]

Implements OAuth 2.1 with PKCE as an alternative authentication method to session tokens. When connecting to a Coder deployment that supports OAuth, users can choose between OAuth and legacy token authentication.

Key changes:

OAuth Flow:

• Add OAuthSessionManager to handle the complete OAuth lifecycle: dynamic client registration, PKCE authorization flow, token exchange, automatic refresh, and revocation
• Add OAuthMetadataClient to discover and validate OAuth server metadata from the well-known endpoint, ensuring server meets OAuth 2.1 requirements
• Handle OAuth callbacks via vscode:// URI handler with cross-window support for when callback arrives in a different VS Code window

Token Management:

• Store OAuth tokens (access, refresh, expiry) per-deployment in secrets
• Store dynamic client registrations per-deployment in secrets
• Proactive token refresh when approaching expiry (via response interceptor timers)
• Reactive token refresh on 401 responses with automatic request retry
• Handle OAuth errors (invalid_grant, invalid_client) by prompting for re-authentication

Integration:

• Add auth method selection prompt when server supports OAuth
• Attach OAuth interceptors to CoderApi for automatic token refresh (+ detach when no longer using OAuth)
• Clear OAuth state when user explicitly chooses token auth
• DeploymentManager coordinates OAuth session state with deployment changes

Error Handling:

• Typed OAuth error classes (InvalidGrantError, InvalidClientError, etc.)
• Parse OAuth error responses from token endpoint
• Show re-authentication modal for errors requiring user action

Closes #586

[EhabY]

#633 includes some open threads that I addressed here but unsure about whether to revert or refine so please check open threads out, mainly:

• Implement OAuth client in VS Code #633 (comment)
• Implement OAuth client in VS Code #633 (comment)
• Implement OAuth client in VS Code #633 (comment)
• Implement OAuth client in VS Code #633 (comment)

[code-asher]

I have not reviewed the test code yet but I tried it out and it looks good!

[code-asher]

Looks good to me! I think we may want to consider an always-attached 401 interceptor, and I wonder if we should remove the clearing from getStoredTokens() to avoid accidentally deleting tokens due to races (we could just return undefined without clearing I think).

[EhabY]

I think we may want to consider an always-attached 401 interceptor, and I wonder if we should remove the clearing from getStoredTokens() to avoid accidentally deleting tokens due to races (we could just return undefined without clearing I think).

I've made the 401 interceptor always attached but re-auths using a callback because I didn't want to change the behavior now (could be a follow up). So now remote.ts uses that to show a dialog and login while extension.ts would just tell the user to login from the workspaces view.

Also I've removed the clearing of tokens in getStoredTokens()!

[code-asher]

sublime!