feat: round-trip the oauth state to the success page

[johnkors]

• An app that can start a Slack install from more than one place — a public landing page and an admin screen, say — can't send the user back to where they started, because every install ends on the one configured SuccessRedirectUri. Closes Distribution middleware drops the OAuth state parameter #47.
• The OAuth state the app sent now comes back to that app's own success page as ?state=, so the page can act on it however it likes.
• Nothing here reads the value. state is opaque by definition — only the app that minted it knows whether it holds a return path, an encoded payload or a CSRF nonce — so interpreting it in a library would be guessing at another app's data.
• Because the redirect target stays the success page the app configured, there's no open-redirect surface to guard against, and an app already using state for CSRF sees no behaviour change at all.
• This is an alternative to Redirect to the OAuth state parameter after a Slack install #48, which resolves the redirect target from state itself. That approach needs an IsLocalUrl guard to stay safe, and still misreads a base64 CSRF nonce that happens to begin with / — roughly one install in sixty-four for an app using one — as a path to redirect to.