fix(security): encode redirect_uri, limit state payload, fix iframe timeout

[lakhansamani]

Summary

• URL encoding (HIGH): redirect_uri and state params in OAuth login URLs are now properly URL-encoded with encodeURIComponent()
• State payload (HIGH): URL state parameter now only serializes clientID, redirectURL, authorizerURL — no longer leaks extraHeaders or other config
• iframe timeout (MEDIUM): executeIframe timeout now properly rejects the promise instead of silently hanging

Files Changed

• src/index.ts — URL encoding + state payload limiting
• src/utils.ts — iframe timeout rejection

Test plan

• Verify OAuth login flow works with special characters in redirect_uri
• Verify state parameter no longer contains extraHeaders
• Verify iframe timeout surfaces error to caller