refactor(oauth): extract CactiOAuth provider factory

[somethingwithproof]

Part F of six PRs splitting #7123. Depends on #7124.

Extracts the OAuth2 provider switch from oauth2.php and the mailer()
function in lib/functions.php into lib/CactiOAuth.php. The factory
returns a configured league/oauth2-client AbstractProvider instance
(or null for unknown providers).

Behavior is unchanged. The two callers were rewritten to use the
unqualified class name; no other oauth2.php / lib/functions.php
logic was touched.

Restructured to the flat lib/CactiX.php convention used by #7088 /
#7073 / #7077 / #7075.

[Copilot]

Pull request overview

This PR refactors Cacti’s OAuth2 provider selection logic by extracting provider construction and default scope options into a centralized Cacti\Security\CactiOAuth helper, and updating the existing OAuth entrypoints to use it. This touches the mail OAuth/identity surface (provider selection and scopes) and adds unit coverage for the new helper.

Changes:

• Introduces lib/Security/CactiOAuth.php with getProvider() and getDefaultOptions() helpers.
• Refactors oauth2.php and the OAuth2 branch of mailer() (lib/functions.php) to use the new helper and handle unknown providers via null.
• Adds tests/Unit/CactiOAuthTest.php coverage for provider selection and default option scopes.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
lib/Security/CactiOAuth.php	Adds centralized OAuth provider factory and default-scope selection.
oauth2.php	Replaces the inline provider switch with calls into CactiOAuth.
lib/functions.php	Replaces duplicated provider switch in mailer() with CactiOAuth usage.
tests/Unit/CactiOAuthTest.php	Adds unit tests for provider selection and default options.

Comments suppressed due to low confidence (1)

lib/functions.php:5635

• If the configured provider name is unknown, $provider becomes null and the code silently skips $mail->setOAuth(...) while still setting AuthType = 'XOAUTH2'. That will likely fail later with a less actionable PHPMailer error. Consider returning a clear error (similar to oauth2.php’s "Unknown OAuth2 provider") when $provider is null, instead of proceeding without OAuth configuration.

		$provider = \Cacti\Security\CactiOAuth::getProvider($providerName, $params);

		if ($provider !== null) {
			$mail->setOAuth(
				new PHPMailer\PHPMailer\OAuth([
					'provider'     => $provider,
					'clientId'     => $clientId,
					'clientSecret' => $clientSecret,
					'refreshToken' => $refreshToken,
					'userName'     => $email,
				])
			);
		}

[somethingwithproof]

Restructured to use flat lib/CactiX.php convention to align with #7088, #7073, #7077, #7075.

[somethingwithproof]

Queue note: this should follow #7124. After #7124 lands, rebase this PR and drop duplicated tests/Helpers/UnitStubs.php and unrelated phpstan baseline churn.