Cross-account session binding via disabled state assertions

CSRF in CORDEA oauth before 0.11 allows remote attackers to bind a resource owner's session to attacker-controlled resources. The Authorization Code and Implicit grant handlers in src/oauth2.nim validate the returned state parameter with plain assert statements, so Nim omits both checks from builds compiled with -d:danger or --assertions:off. Exploitation requires user interaction with an attacker-initiated OAuth flow and affects only builds using those flags; the consequence is unauthorized resource association rather than data modification or service interruption.