[HIGH] security(android): isolate interactive request state

[OskarEichler]

Security impact

Android stores the active Promise, client secret, client-auth method, token headers, PKCE verifier, TLS policy, timeout, and token parameters in module-wide mutable fields. While an authorize flow is waiting for the browser, another authorize, logout, refresh, or registration call can replace that state. The first callback can then exchange its authorization code using another provider's credentials or headers and can settle the wrong Promise. In multi-provider applications this can disclose client credentials across provider trust boundaries and mix authentication results between callers.

Fix

• Keep all delayed interactive-flow state in one immutable PendingFlow snapshot.
• Allow only one browser-based authorize or logout operation at a time; reject overlap with authentication_in_progress.
• Keep refresh and registration independent because their network builders and promises are already local.
• Settle token responses and late failures against the originating Promise.
• Release the interactive slot on cancellation, discovery failure, or launch failure.

This PR is limited to concurrent interactive-flow state. Sequential stale-header reuse and the prefetch deadlock are submitted separately.

Breaking / observable changes

A second authorize or logout call while another browser flow is pending now rejects with authentication_in_progress instead of corrupting the first flow. Callers that intentionally started overlapping browser flows must serialize them.

Verification

• Android demo library compile: BUILD SUCCESSFUL
• Existing Jest suite: 3 suites / 81 tests pass
• Existing ESLint suite passes
• git diff --check passes

The repository has no Android native unit-test target; the fix is verified through the actual Android compilation and existing project suites rather than introducing a new native test framework in this focused patch.

A patch changeset and public error-code type are included. This supersedes only the request-state portion of #1128.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4cfcd67

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
react-native-app-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.