Support "state" parameter in OAuth

Summary:
Ref T1445. Ref T1536. Although we have separate CSRF protection and have never been vulnerable to OAuth hijacking, properly implementing the "state" parameter provides a little more certainty.

Before OAuth, we set a random value on the client, and pass its hash as the "state" parameter. Upon return, validate that (a) the user has a nonempty "phcid" cookie and (b) the OAuth endpoint passed back the correct state (the hash of that cookie).

Test Plan: Logged in with all OAuth providers, which all apparently support `state`.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran, arice

Maniphest Tasks: T1445, T1536

Differential Revision: https://secure.phabricator.com/D6179

src/applications/auth/controller/PhabricatorAuthStartController.php

@@ -62,6 +62,7 @@ final class PhabricatorAuthStartController
 
     if (!$request->isFormPost()) {
       $request->setCookie('next_uri', $next_uri);
+      $request->setCookie('phcid', Filesystem::readRandomCharacters(16));
     }
 
     $out = array();