Security: fix deserialization, timing attack, open redirect, and name bug

[nicdavidson]

Summary

• Critical: Replace unserialize() with json_encode/json_decode for OAuth 1.0 temp credentials — prevents RCE via cache poisoning
• High: Sanitize exception messages in OAuth redirect URLs — prevents internal detail leakage
• High: Default-deny redirect when no domain whitelist configured — prevents open redirect with token theft
• Medium: Use hash_equals() for Heroku SSO token comparison — prevents timing attack
• Bug: Fix || to ?: for user name extraction — was storing boolean true ("1") as the user's name in both BaseOAuthService and Google service

Not addressed (needs discussion)

• Heroku SSO auto-admin (is_sys_admin = true) — business logic decision
• Session token in URL query string — requires frontend changes
• OAuth 1.0 fixed cache key race condition — needs broader refactor
• PKCE support — feature addition

Test plan

• PHP syntax clean on all 5 changed files
• No behavioral change to OAuth 2.0 happy path
• Redirect validation now defaults to same-host when no whitelist