add StateStore
add missing tests
prepare names for StatefulSession
implement state check
fix state key generation
add test coverage
extract magic number to constant
remove reference to state from ClientConfig
uncomment state from AuthorizationResponse error params
introduce auth code AbstractSession
test length of generated state
remove unused `use`
change class names
tweak docs
invert naming of Stateless session
refactor state generation
rename StateMismatchException
test setStateGenerator()
add test
remove invalid TODO

We are validating the params for both success and failure, in the
constructor. This step is checking for an actual authorization error
returned from the server.

Note: state will already have been verified by this point.