fix: accept base64url-encoded nonce in id_token grant

[sushrut1058]

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

In the id_token grant, nonce verification only compares the request nonce against its hex-encoded SHA-256:

hash := fmt.Sprintf("%x", sha256.Sum256([]byte(params.Nonce)))
if hash != idToken.Nonce { ... }

Apple returns the nonce claim as base64url(SHA-256(nonce)), so this hex comparison can never match and Sign in with Apple through the id_token grant always fails with "Nonces mismatch".

What is the new behavior?

Nonce verification now accepts the request nonce hashed as either hex or base64url (unpadded) SHA-256. The hex path is unchanged (backward compatible) and the base64url path fixes Apple.
Fixes #2378

Additional context

Adds a unit test for the comparison helper covering both encodings and rejecting raw / echoed-hash values.

[sushrut1058]

Hey @hf, this PR is a small fix for #2378: Sign in with Apple via the id_token grant always fails with "Nonces mismatch" because the nonce is compared only as hex, but Apple sends it base64url. This accepts both.
Could you approve the CI run and take a look when you get a chance? Thanks!