fix(oauth): Preserve session payload across cycle_key() in authorize flow

[sentry]

This PR addresses a KeyError: 'oa2' that occurred in the /oauth/authorize/ endpoint when an unauthenticated user attempted to log in during an OAuth authorization flow.

Root Cause:
The _logged_out_post method in oauth_authorize.py calls request.session.cycle_key() to prevent session fixation attacks. However, cycle_key() regenerates the session ID and, in doing so, was inadvertently clearing the OAuth payload stored under request.session["oa2"]. Consequently, when the code attempted to access request.session["oa2"]["uid"] immediately after cycle_key(), it resulted in a KeyError.

Solution:
The fix involves preserving the oa2 payload across the cycle_key() operation. Before request.session.cycle_key() is called, the existing request.session["oa2"] data is retrieved and stored in a temporary variable. After cycle_key() has regenerated the session, this saved payload is restored to the new session, and the uid is updated with the authenticated user's ID. Finally, request.session.modified is set to True to ensure the changes are persisted.

This approach maintains the security benefits of cycle_key() while ensuring the necessary OAuth context is not lost during the login process.

Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.