refactor: move OAuth2 provider code to dedicated package (#18746)

# Refactor OAuth2 Provider Code into Dedicated Package

This PR refactors the OAuth2 provider functionality by moving it from the main `coderd` package into a dedicated `oauth2provider` package. The change improves code organization and maintainability without changing functionality.

Key changes:

- Created a new `oauth2provider` package to house all OAuth2 provider-related code
- Moved existing OAuth2 provider functionality from `coderd/identityprovider` to the new package
- Refactored handler functions to follow a consistent pattern of returning `http.HandlerFunc` instead of being handlers directly
- Split large files into smaller, more focused files organized by functionality:
  - `app_secrets.go` - Manages OAuth2 application secrets
  - `apps.go` - Handles OAuth2 application CRUD operations
  - `authorize.go` - Implements the authorization flow
  - `metadata.go` - Provides OAuth2 metadata endpoints
  - `registration.go` - Handles dynamic client registration
  - `revoke.go` - Implements token revocation
  - `secrets.go` - Manages secret generation and validation
  - `tokens.go` - Handles token issuance and validation

This refactoring improves code organization and makes the OAuth2 provider functionality more maintainable while preserving all existing behavior.

coderd/oauth2provider/metadata.go

@@ -0,0 +1,45 @@
+package oauth2provider
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// GetAuthorizationServerMetadata returns an http.HandlerFunc that handles GET /.well-known/oauth-authorization-server
+func GetAuthorizationServerMetadata(accessURL *url.URL) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		metadata := codersdk.OAuth2AuthorizationServerMetadata{
+			Issuer:                        accessURL.String(),
+			AuthorizationEndpoint:         accessURL.JoinPath("/oauth2/authorize").String(),
+			TokenEndpoint:                 accessURL.JoinPath("/oauth2/tokens").String(),
+			RegistrationEndpoint:          accessURL.JoinPath("/oauth2/register").String(), // RFC 7591
+			ResponseTypesSupported:        []string{"code"},
+			GrantTypesSupported:           []string{"authorization_code", "refresh_token"},
+			CodeChallengeMethodsSupported: []string{"S256"},
+			// TODO: Implement scope system
+			ScopesSupported:                   []string{},
+			TokenEndpointAuthMethodsSupported: []string{"client_secret_post"},
+		}
+		httpapi.Write(ctx, rw, http.StatusOK, metadata)
+	}
+}
+
+// GetProtectedResourceMetadata returns an http.HandlerFunc that handles GET /.well-known/oauth-protected-resource
+func GetProtectedResourceMetadata(accessURL *url.URL) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		metadata := codersdk.OAuth2ProtectedResourceMetadata{
+			Resource:             accessURL.String(),
+			AuthorizationServers: []string{accessURL.String()},
+			// TODO: Implement scope system based on RBAC permissions
+			ScopesSupported: []string{},
+			// RFC 6750 Bearer Token methods supported as fallback methods in api key middleware
+			BearerMethodsSupported: []string{"header", "query"},
+		}
+		httpapi.Write(ctx, rw, http.StatusOK, metadata)
+	}
+}