fix: constrain the mongodb objectid regex format and use match

[frankchn]

Problem

See #2539, which this closes.

Solution

1. Applies a more intense regex check to the SPCP return path (making sure that the ObjectID in the path is actually a valid ObjectID)
2. Use str.match(regex) instead of regex.exec(str) as part of best practices.

Breaking Changes

• No - this PR is backwards compatible

Tests

Make sure that SPCP login still works.

[karrui]

lgtm