seejupyterhub/oauthenticator#765 for implementing PKCE in OAuthenticator. This does the same in jupyterhub's oauth clients and adds what is needed for the provider side (oauthlib implements the verification, we only need to implement the db persistence of the challenge)

PKCE is currently optional for backward-compatibility

Since this adds db columns, this means a major version bump according to#3982

TODO:

• opt-in config toenforce PKCE
• tests
  • failed PKCE validation
  • missing PKCE works when not required
  • missing PKCE doesn't work when PKCE is required
• explore backward-compatibility implications in HubOAuth defaults
• update examples (if defaults don't enable PKCE)

It would be nice for PKCE to happen by default, but we need to make sure that existing code will either transparently send both the challenge and the verifier or neither, because e.g. sending the challenge but not the verifier will cause every oauth to fail. Sending neither is still okay as long asrequire_pkce is not enabled, which will be opt-in.