fix(oidc): the fake provider takes the client's credentials form-encoded

The module sends the client's ID and secret form-encoded inside Basic
authentication, as RFC 6749 (2.3.1) has them; the fake compared the header
with them raw, so a host testing with a secret holding a space or a colon
saw every code refused. A test now holds the module to the encoding.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_oidc_server/lib/src/testing/fake_provider.dart

@@ -157,8 +157,11 @@ final class FakeProvider {
   }
 
   http.Response _token(http.Request request) {
-    final basic =
-        'Basic ${base64.encode(utf8.encode('$clientId:$clientSecret'))}';
+    // The client's ID and secret form-encoded first (RFC 6749, 2.3.1).
+    final credentials =
+        '${Uri.encodeQueryComponent(clientId)}:'
+        '${Uri.encodeQueryComponent(clientSecret)}';
+    final basic = 'Basic ${base64.encode(utf8.encode(credentials))}';
     final form = request.bodyFields;
     final code = _codes.remove(form['code']);
     if (request.headers['authorization'] != basic ||