OAuth module missing special handling for loopback redirect URI

[hickford]

OAuth RFC https://datatracker.ietf.org/doc/html/rfc8252#section-7.3 describes special handling for loopback redirect URIs, in particular that the port need not match.

The authorization server MUST allow any port to be specified at the
time of the request for loopback IP redirect URIs, to accommodate
clients that obtain an available ephemeral port from the operating
system at the time of the request.

This is vital for local apps, but the behaviour is missing in Gitea.
Relevant code

gitea/models/auth/oauth2.go

Lines 58 to 60 in 5a3b9ac

	func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool {
	return util.IsStringInSlice(redirectURI, app.RedirectURIs, true)
	}

GitHub implements this behaviour https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps#localhost-redirect-urls

The redirect_uri does not need to match the port specified in the callback url for the app.