pub fn pkce_code_challenge(verifier: &str) -> String
Derive the PKCE code challenge (S256) from a verifier: the base64url(sha256(verifier)) per RFC 7636 section 4.2.
base64url(sha256(verifier))