Refactor auth flow session handling

[JoTiTu]

Short description of what this resolves:

• Uses the state parameter from the OAuth2.0 specs to handle the session instead of an query parameter (https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1)
• removes the haip and openid4vp scheme check to allow verified deeplinks.