CVE-2026-84312: Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

In the Casdoor SSO flow, the OAuth state parameter is hard-coded to settings.CasdoorSettings.Application — a value identical for every user and every login. The callback handler accepts whatever state the client sends without comparing it to anything stored in the user agent, enabling a login-CSRF: an attacker can force the victim’s browser to authenticate as the attacker.