fix(client/auth): preserve an authorization endpoint's existing query parameters

[dgilman-perplexity]

Fixes #3505, fixes #2776.

Motivation

RFC 6749 §3.1 allows the authorization endpoint URI to include a query component, but the client builds the authorization URL with a bare f"{endpoint}?{params}". Any discovered authorization_endpoint that already carries a query (e.g. Salesforce's ...?prompt=select_account) gets a second ? and a broken URL. We hit this in production and currently work around it with a subclass override.

Change

_perform_authorization_code_grant now builds the URL through a _build_authorization_url helper that merges the flow's parameters into the endpoint's existing query (parse_qsl/urlunparse, blank values preserved). Regression test included; it fails on main and passes with the fix.

#2779 takes the same approach but predates the httpx2 rename and no longer applies cleanly to main.

🤖 Generated with Claude Code

[github-actions]

This PR has been closed automatically. It's still a draft, but we close those early so you don't put in more time only to have it closed the moment you mark it ready.

This repo only keeps pull requests open when they come from a maintainer, or from a contributor a maintainer has assigned to the linked issue, and you aren't currently assigned to #3505, #2776.

If a maintainer assigns you to #3505, #2776, this PR reopens on its own and there's nothing more you need to do here. Assignment is a maintainer call based on capacity; comments that only ask to be assigned don't factor in. What does help is engaging on the issue itself by confirming the repro, explaining why it matters for your use case, or describing the approach you'd take.

You're welcome to keep pushing commits here (just avoid force-pushing, since GitHub can't reopen a rewritten branch), but that on its own won't get the PR reviewed or the issue assigned, and realistically most auto-closed PRs stay closed. There's no need to open a new PR either way.

CONTRIBUTING.md has the full reasoning, but in short:

• We're a small team with very little capacity to review community PRs right now.
• Many recent PRs are AI-generated with little human review, and reviewing one carefully still costs a maintainer as much time as it ever did. A well-described issue is usually more useful to us than the code.

Maintainers: reopen, remove missing-issue-link, or add bypass-issue-check to override.