RFC 7636 S256 challenge: base64url(sha256(verifier)), unpadded.
static String codeChallengeFor(String verifier) => _base64Url(sha256.convert(ascii.encode(verifier)).bytes);