feat: implement authorization code flow for anvil prod (anvil-cmg/prod) (#4851)

[frano-m]

Summary

• Switches AnVIL prod (anvil-cmg/prod) Google OAuth from implicit to authorization code flow.
• New client ID provisioned for the auth-code flow on the same Google Cloud project.
• Adds the `authorize` endpoint URL targeting prod Azul (`https://service.explore.anvilproject.org/user/authorize\`).
• Mirrors the anvil-cmg/dev migration; `authentication/authentication.ts` and `config.ts` are unchanged because the const-export pattern is preserved.

Closes #4851

Test plan

• Sign in to prod AnVIL Data Browser and complete the Terra OAuth round-trip
• Sign out cleanly
• Refresh-token flow exercised end-to-end via Azul (verifies the auth-code intent — critical-path for the mirror-MA effort in DataBiosphere/azul-private#359)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the AnVIL CMG production site configuration to use Google OAuth’s authorization code flow (instead of implicit) to support Azul refresh-token behavior in prod.

Changes:

• Switch anvil-cmg/prod Google OAuth flow from IMPLICIT to AUTHORIZATION_CODE.
• Update the Google OAuth client ID to the newly provisioned auth-code client.
• Add the prod Azul /user/authorize endpoint as the OAuth authorize URL.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.