[SDK-1927] Check for state param in callback url

[adamjmcgrath]

Description

Because SPA JS always sends a state param to /authorize, we can always assume that a valid redirect callback will contain both state and code.

Doing this will reduce the chance of collisions when the application is using the code param for something unrelated to auth.

References

Might mitigate some cases of #75

Testing

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master