fix(sdk): reject unsafe redirect URIs and duplicate OAuth callback params

[thecompez]

Changes

• Reject javascript:, data:, and file: redirect URI schemes, and redirect URIs with fragments.
• Reject duplicate code, state, or iss OAuth callback parameters rather than silently processing the first occurrence.
• Preserve custom native-app URI schemes.

Regression tests

• New negative config tests and duplicate callback query tests fail against pre-fix SDK.
• node sdk/javascript/test.mjs — passed after fix.
• python3 scripts/verify-openapi.py — passed (87 paths, 111 operations).
• git diff --check — passed.

Operational safety

• SDK-only change in an isolated worktree from origin/main.
• No changes to production binaries, server config, database, running services, or application deployment.
• Review CI before marking ready or merging.