[flutter_appauth][iOS] Support HTTPS redirect URIs on iOS 17.4+

[KhaleelSH]

Summary

This adds support for HTTPS redirect URIs on iOS 17.4 and newer by using ASWebAuthenticationSessionCallback with callbackWithHTTPSHost:path: when the request redirect URL uses the https scheme.

The change applies to both default and ephemeral ASWebAuthenticationSession flows. Custom-scheme redirects continue to use the existing callbackURLScheme: path, and SFSafariViewController behavior is unchanged.

What Changed

• Route default and ephemeral iOS ASWebAuthenticationSession flows through the custom iOS external user agent.
• Pass the request redirect URL into the user agent so HTTPS redirect URLs can use the iOS 17.4+ callback API.
• Keep custom-scheme redirects on the legacy callback scheme initializer.
• Guard nil or malformed redirect URLs, including end-session requests without postLogoutRedirectUrl, so the HTTPS callback API is only used when a valid HTTPS host is available.
• Treat host-only HTTPS redirect URLs as the root path when constructing the callback.
• Document the required webcredentials:<host> Associated Domains setup and matching apple-app-site-association configuration.

Notes

Apple's HTTPS callback API uses associated web credentials domains. It is not the normal applinks universal-link flow, so the README calls out the required webcredentials entitlement.

HTTPS redirect URIs only work on iOS 17.4 and newer because the required ASWebAuthenticationSession callback initializer is unavailable on earlier iOS versions. Apps that still support older iOS versions should keep a custom-scheme redirect fallback registered with their identity provider.

Testing

• melos run analyze
• melos run test:unit --no-select
• melos run build:example_ios
• xcrun clang-format --dry-run --Werror flutter_appauth/ios/flutter_appauth/Sources/flutter_appauth/OIDExternalUserAgentIOSNoSSO.m flutter_appauth/ios/flutter_appauth/Sources/flutter_appauth/OIDExternalUserAgentIOSNoSSO.h flutter_appauth/ios/flutter_appauth/Sources/flutter_appauth/AppAuthIOSAuthorization.m
• git diff --cached --check

[MaikuB]

Thanks for the PR. I left a comment here that is relevant to this PR too. For convenience, what I mean to say is I'll be holding off on this one right now. It would be better if the AppAuth iOS SDK handles it as this PR would become obsolete if this is merged in and released

[KhaleelSH]

That would be the ideal solution. I'm just a bit afraid that that PR is still open since a while, and would take more time to get merged. But anyways, thank you for letting me know you're holding off on this, I believe I'll use my fork until the mentioned PR is merged. Have a nice day.

[travishaagen]

@MaikuB I would like to advocate for this PR to be reviewed and merged. I stumbled on this PR, because I also need it.

It's not clear that the maintainers of AppAuth-iOS have even acknowledged openid/AppAuth-iOS#938 and leading authentication providers (example) have been saying for a while that custom URL schemes are not secure.

[MaikuB]

@travishaagen understood however I'm busy ATM as I'm in the process. If you haven't done so already or weren't aware, note that you can create a fork based on this PR and use it directly in your app in the meantime