Stop leaking customer email domain in cassette guard → Add PKCE coverage tests for entropy and replay

- Stop leaking customer email domain in cassette guard
- Deep-copy ExtraAuthParams in ApplyProviderDefaults
- Drop raw monday graphql error from returned errors
- Add PKCE coverage tests for entropy and replay

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/monday.go

@@ -165,7 +165,9 @@ func (d *MondayDriver) queryUsers(ctx context.Context, page int) ([]mondayUser,
 	}
 
 	if len(resp.Errors) > 0 {
-		return nil, fmt.Errorf("monday graphql error: %s", resp.Errors[0].Message)
+		// Provider-supplied error messages may carry tenant identifiers
+		// or query fragments — never embed them in the returned error.
+		return nil, fmt.Errorf("cannot fetch monday users: graphql error")
 	}
 
 	return resp.Data.Users, nil