Correct implementation of rfc7636 section 4.1

[jfyne]

I came across an issue with the code_verifier parameter when requesting a token using the Code flow and PKCE using Ory Hydra (#628). After a discussion with @jeroenheijmans and reading the spec he pointed me to https://tools.ietf.org/html/rfc7636#section-4.1 it looks as though the createNonce function was implemented slightly incorrectly. This leads to an incorrectly base64url encoded string being generated which the Go standard library being used in Ory Hydra would not parse. This PR changes the generation to follow the spec more closely:

1. Generate a high entropy cryptographic string

code_verifier = high-entropy cryptographic random STRING using the
unreserved characters [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"
from Section 2.3 of [RFC3986], with a minimum length of 43 characters
and a maximum length of 128 characters.

2. Then base64url encode the high entropy string

The octet sequence is then base64url-encoded to produce a
43-octet URL safe string to use as the code verifier.

I have tested this both with Ory Hydra and IndentityServer4.