Support OIDC code flow nonce

[sberyozkin]

Description

@pedroigor has proposed that quarkus-oidc also generates nonce when redirecting to Keycloak which will help to minimize the ID token replay risk.
It may also make sense to optionally enforce c_hash and at_hash along the way as well to minimize the code/access token substitution risks - and all of these checks can be enforced when the strict profile will be enabled

Implementation ideas

No response

[quarkus-bot]

/cc @pedroigor

[sberyozkin]

I've removed c_hash, at_hash from this feature request - as adding nonce is big enough enhancement of its own, I'll deal with c_hash, at_hash as needed in different issues