Support LinkedIn confidential OAuth without PKCE

[baggiiiie]

Summary

LinkedIn's standard confidential authorization-code flow rejects token exchanges that include code_verifier, but Executor adds PKCE to every authorization-code connection. this leaves valid LinkedIn client credentials failing with invalid_client during token exchange.

this change omits PKCE only for confidential clients using LinkedIn's standard HTTPS authorization endpoint. public clients, LinkedIn's native-PKCE endpoint, and other providers keep PKCE.

Note

NOTE: the same unconditional PKCE behavior also exists on v2 branch.

Linked issue

Fixes #2087

Verification

• bun run format:check
• bun run lint
• bun run --cwd packages/core/sdk typecheck
• bun run --cwd packages/core/sdk test — 64 test files, 947 tests passed

Checklist

• Added a changeset (bun run changeset), or this change needs none.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.