Add a double-submit cookie in the OAuth flow

Prevents CSRF attacks by ensuring that the state parameter is tied to a cookie.

Fix https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625