feat: implement PKCE support in native Google OAuth flows

- Added `generate_code_verifier` function to create a PKCE code verifier for enhanced security.
- Updated Google Calendar, Drive, and Gmail connector routes to utilize the PKCE code verifier during OAuth authorization.
- Modified state management to include the code verifier for secure state generation and validation.

surfsense_backend/app/utils/oauth_security.py

@@ -11,6 +11,8 @@ import hmac
 import json
 import logging
 import time
+from random import SystemRandom
+from string import ascii_letters, digits
 from uuid import UUID
 
 from cryptography.fernet import Fernet
@@ -18,6 +20,14 @@ from fastapi import HTTPException
 
 logger = logging.getLogger(__name__)
 
+_PKCE_CHARS = ascii_letters + digits + "-._~"
+_PKCE_RNG = SystemRandom()
+
+
+def generate_code_verifier(length: int = 128) -> str:
+    """Generate a PKCE code_verifier (RFC 7636, 43-128 unreserved chars)."""
+    return "".join(_PKCE_RNG.choice(_PKCE_CHARS) for _ in range(length))
+
 
 class OAuthStateManager:
     """Manages secure OAuth state parameters with HMAC signatures."""