Function verify_pkce 

fn verify_pkce(code_verifier: &str, code_challenge: &str) -> bool

Verifies a PKCE code_verifier against the code_challenge an authorization code was issued with. S256 only — this server refuses plain at PAR, so nothing here needs to handle it.