Match redirect URIs exactly, not just scheme/host/port/path #7

`Client::check_redirect_uri()` ignores query string and fragment when comparing the supplied redirect URI against the registered ones. RFC 9700 §2.1.1 recommends exact matching — this is the other half of code-injection defence alongside PKCE (#1): an attacker who can append query params to an otherwise-valid registered redirect URI can redirect the authorization response somewhere they control.