Document StateStore instance property design to clarify race condition safety

[Copilot]

The StateStore class uses instance properties (state, codeVerifier) that could appear to have race conditions when multiple calls to set() occur before toString() is called. However, each OAuth2 authentication flow creates its own StateStore instance, making this design safe.

Changes

Added documentation to clarify the design pattern:

• Instance properties: Documented that state and codeVerifier track the "current" state for the next toString() call, with each OAuth2Strategy creating its own instance per request
• set() method: Explained the dual purpose of setting instance properties for serialization while maintaining collections for validation
• toString() method: Clarified that only instance properties are serialized (not the entire collection), which is intentional since each flow has its own instance

The documentation makes explicit that this pattern prevents race conditions rather than creating them.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.