Add --callback-addr flag to support running behind TLS-terminating proxies by decoupling the callback server bind address from the redirect URL and using certificate presence to determine protocol.

[mbilski]

Fixes #140

• Add --callback-addr flag to override callback server bind address
• Change protocol selection to be based on TLS certificate presence instead of redirect URL scheme

This enables oauth2c to work behind TLS-terminating proxies where the public redirect URL is HTTPS but the local callback server needs to bind to a different address and serve plain HTTP.

oauth2c --redirect-url https://example.com/callback --callback-addr 0.0.0.0:8080