Issuer, client, redirect URI, and optional scope.
Optionalhints: AuthorizationHints
Optional connection / login-hint to skip the issuer's provider chooser.
The pending authorization to store before navigating to
authorizeUrl.
Most integrations should use createUpbond instead.
Build the issuer authorization URL for an authorization-code + PKCE login and the PendingAuthorization state that must be persisted across the redirect. Generates fresh
state,nonce, and PKCE verifier; only the S256 challenge leaves the client.