callback_handler.go: assert behavior about PKCE and IDSession storage

Also aggresively refactor for readability:
- Make helper validations functions for each type of storage
- Try to label symbols based on their downstream/upstream use and group them
  accordingly

Signed-off-by: Andrew Keesler <akeesler@vmware.com>

internal/oidc/callback/callback_handler.go

@@ -304,11 +304,11 @@ func makeDownstreamSession(issuer, clientID, nonce, username string, groups []st
 			Issuer:      issuer,
 			Subject:     username,
 			Audience:    []string{clientID},
+			Nonce:       nonce,
 			ExpiresAt:   now.Add(downstreamIDTokenLifetime),
 			IssuedAt:    now,
 			RequestedAt: now,
 			AuthTime:    now,
-			Nonce:       nonce,
 		},
 	}
 	if groups != nil {