OAuth: Fix Broken Access Control

[n7studios]

Summary

Validates OAuth authorization requests before exchanging the authorization code for an access token:

• The user must be logged in with the manage_options capability.
• The request must include a valid nonce, which proves the same user started the Connect flow.

Kit's OAuth redirect only keeps the page, tab and section parameters from the return URL. page must stay convertkit-mm, so the nonce is sent and returned in tab (tab=convertkit-mm-oauth-{nonce}). After a successful exchange, the Plugin redirects back to the standard settings screen.

maybe_disconnect() now also checks for the manage_options capability.

Testing

• testAuthorizationCodeNotExchangedWhenUnauthenticated: confirms no authorization code is exchanged, and credentials stay unchanged, for requests from logged-out users.
• testAuthorizationCodeNotExchangedWithoutNonce: confirms the same when an Administrator's request has a missing or invalid nonce.
• testNoCredentials: updated to decode the OAuth state parameter and check the return URL includes the nonce.
• Checked manually: connecting to Kit through OAuth still works.

Checklist

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR (if you're not sure who to assign, we can do this step for you)