refactor(server): extract the device flow into its own package

Move the OAuth2 device authorization grant (RFC 8628) out of the god Server
into a server/device package, following the router.Handler pattern:

- server/device holds a Handler that mounts /device, /device/code,
  /device/auth/verify_code, /device/callback and the deprecated /device/token,
  and exposes HandleToken for the device_code grant. It holds only its
  dependencies (storage, templates, issuer URL, timing, logger) plus the shared
  ExchangeAuthCode and CalculateCodeChallenge callbacks and a RenderError
  callback, so it does not depend on the whole Server.
- newServer (the composition root) builds the handler as a local and wires it in
  two places: the mount list, and the /token endpoint, which receives the
  device_code grant as a parameter instead of the Server building or holding the
  handler itself.
- The PKCE code-challenge method names move to the oauth2 package as
  PKCEMethodPlain/PKCEMethodS256, next to the rest of the protocol vocabulary.

No behaviour change. The device unit test covers the verification URI; the
end-to-end device tests keep exercising the wired routes through the server.

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

server/device/device.go

@@ -0,0 +1,16 @@
+package device
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetDeviceVerificationURI(t *testing.T) {
+	u, err := url.Parse("https://dex.example.com/non-root-path")
+	require.NoError(t, err)
+
+	h := &Handler{IssuerURL: *u}
+	require.Equal(t, "/non-root-path/device/auth/verify_code", h.getDeviceVerificationURI())
+}

server/device/device_test.go

@@ -12,32 +12,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/dexidp/dex/server/device"
 	"github.com/dexidp/dex/storage"
 )
 
-func TestDeviceVerificationURI(t *testing.T) {
-	t0 := time.Now()
-
-	now := func() time.Time { return t0 }
-	// Setup a dex server.
-	httpServer, s := newTestServer(t, func(c *Config) {
-		c.Issuer += "/non-root-path"
-		c.Now = now
-	})
-	defer httpServer.Close()
-
-	u, err := url.Parse(s.issuerURL.String())
-	if err != nil {
-		t.Fatalf("Could not parse issuer URL %v", err)
-	}
-	u.Path = path.Join(u.Path, "/device/auth/verify_code")
-
-	uri := s.getDeviceVerificationURI()
-	if uri != u.Path {
-		t.Errorf("Invalid verification URI.  Expected %v got %v", u.Path, uri)
-	}
-}
-
 func TestHandleDeviceCode(t *testing.T) {
 	t0 := time.Now()
 
@@ -135,7 +113,7 @@ func TestHandleDeviceCode(t *testing.T) {
 				t.Errorf("Could read token response %v", err)
 			}
 			if tc.expectedResponseCode == http.StatusOK {
-				var resp deviceCodeResponse
+				var resp device.DeviceCodeResponse
 				if err := json.Unmarshal(body, &resp); err != nil {
 					t.Errorf("Unexpected Device Code Response Format %v", string(body))
 				}