support universal link as redirect url

[shidoro]

For iOS, when version 17.4+ is available, check whether the redirect url is a universal link. If it is, use the new init method with callback accepting the universal link.

[shidoro]

I believe this is related to #847 and #367

[weihenglim]

Heads up: If you’re planning to use this, note that HTTPS callbacks require the webcredentials service. You’ll need to add it to your AASA and Runner.entitlements if you previously only had applinks. With that in place, I can confirm this PR works great.

[yasmin-ravenwolfe]

I can also confirm - this works great!

Forked AppAuth-iOS locally with this PR applied, with the webcredentials AASA and entitlement config for the redirect url. The OAuth flow completes end-to-end with session-binding routing the callback back to the originating app. Echoing @weihenglim — works as expected with the webcredentials prerequisite documented in their comment.

Is there a maintainer who could pick this up for review? @w-goog — would love your eyes on this when you have a moment. Happy to help shepherd it through / make any requested changes if that helps unblock.

[KhaleelSH]

Any updates on this PR? It would be great if we can have it ASAP. @w-goog

[w-goog]

Thank you for the bump, Khaleel! This PR is going to need some work before we merge it, but I'd be happy to try and get it in the post-3.0.0 release. I'll add real comments soon. Quick hits in case someone wants to address them before a formal review:
0. A static class helper - something like static ASWebAuthenticationSessionCallback *_Nullable OIDHTTPSCallbackForRequest(id<OIDExternalUserAgentRequest> request) - would let us write a unit test for this.

1. The unchecked downcast will introduce a crash (try passing OIDEndSessionRequest in to -presentExternalUserAgentRequest).
2. prefersEphemeralWebBrowserSession needs to be set (it's hardcoded to NO in this block)
3. Technically this should have a #if __IPHONE_OS_VERSION_MAX_ALLOWED >= 130000, though I am about to bump the version, so, it will be unnecessary by the time we get it in a release.
4. The import should be fixed, it will fail under SPM.
5. We should consider throwing on a malformed redirect, if that's a reachable code path (I wasn't able to test this one yet, but, I think a nil host will hang).
6. if (@available(iOS 17.4, *) && cond) is going to be an error with -Werror - this needs to be nested.

I'm sorry for the delay - my workflow previously did not do a good job of catching older PRs / issues that had been bumped. I've addressed that going forward :)