Add option to disable PKCE on signInWithExternalAuth

[rahul1]

Right now, our authentication methods, including signInWithExternalAuth, add a code_challenge and code_challenge_method to enable PKCE authentication.

Some 3rd party identity providers, such as Azure SSO, decide whether or not to enable PKCE authentication based on whether the client initiates in their call to /authorize

To allow clients to disable PKCE for these IDPs, we should allow them to disable sending PKCE params in the signInWithExternalAuth calls