fix(op): do not redirect to unverified uri on error

[muhlemmer]

Re-arrange Auth request validation.

1. Input validation is done for required parameters.
2. The request may include a request object, then it needs to be validated and data added to the request.
3. The client is retreived from Storage.
4. The request_uri is validated against the Client's configuration.
5. Remaining validations are done.

Any error from step 1 up till and including 4 will not result in a redirect. The error is returned to the user-agent.
Errors from 5 and beyond will result in a redirect.

This fixes behavior to be compliant with Oauth2 RFC 6749, section 4.1.2.1:

If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.

Closes #627

Note: This PR does address the op.Server interface for 2 reasons:

1. The bug is not applicaple there, because it doesn't redirect in most error cases. This is incorrect, but should be solved seprately. At least there is no security issue there.
2. Allow this fix to be backprorted to v2.

Definition of Ready

• I am happy with the code
• Short description of the feature/issue is added in the pr description
• PR is linked to the corresponding user story
• Acceptance criteria are met
• All open todos and follow ups are defined in a new ticket and justified
• Deviations from the acceptance criteria and design are agreed with the PO and documented.
• No debug or dead code
• My code has no repetitions
• Critical parts are tested automatically
• Where possible E2E tests are implemented
• Documentation/examples are up-to-date
• All non-functional requirements are met
• Functionality of the acceptance criteria is checked manually on the dev system.

[github-actions]

🎉 This PR is included in version 3.27.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀