Address second-round review findings in the PKCE core

- Enqueue the expiry job and the "app connected" notification on
  after_commit instead of after_create, so they only fire once the (now
  transactional) code exchange commits
- Enforce the PKCE code_challenge format (43-128 unreserved chars, S256)
  with model validations, not only at the controller
- Drop the now-unused RsAuthorizationCode#expired?
- Cover the client_id-vs-stored-client_id check

Part of #254

app/models/rs_authorization_code.rb

@@ -9,6 +9,10 @@ class RsAuthorizationCode < ApplicationRecord
 
   before_validation :generate_code
 
+  validates :code_challenge, presence: true,
+            format: { with: /\A[A-Za-z0-9\-._~]{43,128}\z/ }
+  validates :code_challenge_method, inclusion: { in: %w[S256] }
+
   scope :active, -> { where(expires_at: Time.current..) }
 
   def self.find_by_code(raw_code)
@@ -17,10 +21,6 @@ class RsAuthorizationCode < ApplicationRecord
     active.find_by(code_digest: Digest::SHA256.hexdigest(raw_code))
   end
 
-  def expired?
-    expires_at <= Time.current
-  end
-
   private
 
     def generate_code