Implement authorization code flow for AnVIL prod (anvil-cmg/prod)

[frano-m]

Part of #4793.

Context

#4793 introduces the OAuth authorization code flow (replacing the implicit flow) for the Azul refresh-token use case. Confirmed working for `dev` and `anvildev` (anvil-cmg/dev). This ticket covers the AnVIL prod (anvil-cmg/prod) environment.

New OAuth client ID has been provisioned for the auth-code flow on AnVIL prod:

```
1055427471534-8ee4mhig5j40n6n366j7uul26bbbhp2p.apps.googleusercontent.com
```

(Same Google Cloud project as the existing implicit-flow client `1055427471534-r7j5sdnhv47cuq10nsdejrc0pajd1qqv...`.)

Scope

Mirror the anvil-cmg/dev migration in `site-config/anvil-cmg/prod/authentication/constants.ts`:

• Keep the `GOOGLE_PROVIDER` constant pattern (anvil-cmg/dev keeps the const + hardcoded `authorize` URL — no factory).
• Add `authorize: "https://service.explore.anvilproject.org/user/authorize"\`.
• Change `flow` from `OAUTH_FLOW.IMPLICIT` → `OAUTH_FLOW.AUTHORIZATION_CODE`.
• Update the client ID to the new value above.

No changes needed in `authentication/authentication.ts` or `config.ts` (the const pattern is unchanged).

Acceptance

• AnVIL prod (anvil-cmg/prod) uses the auth-code flow with the new client ID.
• Sign-in / sign-out work against the prod Azul (`https://service.explore.anvilproject.org\`).
• Refresh-token flow verified end-to-end. On the critical path for the mirror-MA effort (DataBiosphere/azul-private#359 mentioned in Implement authorization code flow with Azul and Data Browser #4793).

Closes part of #4793.