Auth: Place redirect_url in fragment rather than query parameter

[scblack321]

Request from WMA to have the returned redirect_url located in fragment rather than a query parameter for when response_type is token.

[nathanfranklin]

for when response_type is token. 👍

---

For the client-side auth flow in Tapis where response_type=token (implicit grant), the callback returns the token as a query parameter (?) instead of a hash fragment (#). For security purposes, it should be a hash fragment so that user tokens don't show up in server logs or referrer headers.

I first noticed this with Hazmapper/Taggit when we switched to Tapis V3 (in V2, it was returned as a hash fragment). We've since changed our auth flow in Hazmapper/Taggit, so it's no longer a concern for those apps. However, we have a demo app that still uses this flow, so I wanted to bring it to y'all's attention.
[9:49 AM]https://github.com/TACC/imageInf/blob/main/client/src/pages/Login.tsx#L23-L30

https://github.com/TACC/imageInf/blob/main/client/src/pages/Callback.tsx#L12-L18

[scblack321]

@nathanfranklin , please work with @kevinpricethesecond to fill in details.