chore: remove an unused nonce from OAuth flow

[woodruffw]

Our OAuth flow uses authorization_code, in which nonce is not required and has no effect.

[woodruffw]

Note: fixed this as a very minor but technically invalid Liskov Substitution.

[woodruffw]

This error makes zero sense to me:

ERROR: In --require-hashes mode, all requirements must have their versions pinned with ==. These do not:
    importlib_resources~=5.7 from https://files.pythonhosted.org/packages/7a/68/bd9dd6bbf06772c7accce77d0354d783333fbe712a60b08fc13540c05422/importlib_resources-5.13.0-py3-none-any.whl (from sigstore==4.1.0->-r install/requirements.txt (line 446))
Error: Process completed with exit code 1.

I don't understand how it even sees that importlib_resources version, since we're not actually doing any dependency resolution here, just installed from a fully hashed requirements.

Ah, this is probably pypa/pip#9644.

[jku]

Agreed