(core) Fix OAuth flows in popups by removing the COOP protection from OAuth flows.

Summary:
COOP (Cross-Origin-Opener-Policy) was set on login pages to prevent
certain kinds of attack; then applied blindly to oauth interaction
pages. But OAuth flows are often done via a popup window, and rely on
postMessage to return the token to the caller, which relies on
`window.opener` being available (that's what COOP header blocks).

In fact, other providers with OAuth flows (Google, Microsoft, GitHub,
Auth0, Airtable) do NOT seem to set COOP header at all, on either oauth
interaction pages or login pages.

This diff removes the COOP header from oauth pages, but keeps it on
SaaS login pages. The latter is out of abundance of caution, to avoid
removing the part of the protection that was added intentionally. It
does mean that a popup-based OAuth flow by a user who is not signed in
will still sever the window.opener link when going through the login
page, and the client will fail to get the code. However simply trying
again should succeed, since the user would already be signed in. So it's
a compromise, and the remaining breakage is a rare recoverable stumble
rather than a permanent blocker for popup-based flows.

The diff also adds comprehensive error logging for oidc-provider endpoints.

Test Plan: Test added that interaction pages retain no-framing header, but not COOP header.

Reviewers: paulfitz

Reviewed By: paulfitz

Differential Revision: https://phab.getgrist.com/D5044