fix: Address code review feedback for OAuth SSO

- Add proper lifecycle management for state cleanup interval
- Fix host header injection vulnerability by validating forwarded headers
- Add type safety for GitHub API responses
- Add stopStateCleanup function for test cleanup
- Document scaling limitations of in-memory state store

Co-authored-by: samanhappy <2755122+samanhappy@users.noreply.github.com>

tests/services/oauthSsoService.test.ts

@@ -24,6 +24,7 @@ import {
   isLocalAuthAllowed,
   getPublicProviderInfo,
   clearProviderCache,
+  stopStateCleanup,
 } from '../../src/services/oauthSsoService.js';
 
 describe('OAuth SSO Service', () => {
@@ -32,6 +33,11 @@ describe('OAuth SSO Service', () => {
   >;
   const mockGetUserDao = daoModule.getUserDao as jest.MockedFunction<typeof daoModule.getUserDao>;
 
+  // Stop the cleanup interval to prevent Jest from hanging
+  afterAll(() => {
+    stopStateCleanup();
+  });
+
   const defaultSsoConfig = {
     enabled: true,
     allowLocalAuth: true,