Enhancement: configurable shared outbound OAuth/OIDC HTTP client hardening

[michaelw]

Summary

The generic oauth2 provider in #300 uses a fixed hardened outbound HTTP client for discovery, userinfo, and token exchange. That is a good incremental safety improvement, but the timeout and transport policy should be configurable and reusable across the OAuth/OIDC provider surface.

Goal

Introduce a shared outbound OAuth/OIDC HTTP client with configurable policy, rather than hardcoding a package-level client inside the generic oauth2 provider.

Desired scope

• Configurable total timeout for outbound OAuth/OIDC calls
• Optional transport settings:
  • dial timeout
  • TLS handshake timeout
  • response header timeout
  • idle conn timeout
  • max idle connections
  • max idle conns per host
  • max conns per host
• Response size limits for discovery and userinfo payloads
• Reuse across:
  • generic oauth2
  • oauth2.google
  • GitHub OAuth and similar provider-specific OAuth flows

Explicit non-goal for the first pass

• Do not automatically fold InvokeHttpRequest(...) or the app-wide HTTP stack into this work unless we intentionally expand the design later. This should start as an OAuth/OIDC-focused client policy.

Notes

• The first follow-up can reasonably start with configurable total timeout only, then expand to transport knobs if needed.
• Keep context deadlines in request flows even when a shared client timeout exists.