pub fn derive_code_challenge(verifier: &str) -> String
Derive the code_challenge from a code_verifier using S256 (SHA-256 + base64url).