fix(security): escape error text in OIDC error pages

OIDC error responses interpolated parse-error/exception and error_description
text straight into HTML. idpyoidc currently emits canned messages, but this is
the same reflected-XSS class as the validation-error fix; relying on upstream
not to echo input is fragile.

Add a shared _error_page() helper that HTML-escapes the message and route all
six dynamic error responses through it.

Refs: porchlight-8iw

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_oidc/test_authorization.py

@@ -2,6 +2,16 @@ import secrets
 
 from httpx import AsyncClient
 
+from porchlight.oidc.endpoints import _error_page
+
+
+def test_error_page_escapes_html() -> None:
+    # OIDC error pages must not interpolate request-derived text as raw HTML.
+    resp = _error_page("<script>alert(1)</script>")
+    body = resp.body.decode()
+    assert "<script>" not in body
+    assert "&lt;script&gt;alert(1)&lt;/script&gt;" in body
+
 
 def _register_test_client(
     client: AsyncClient,