feat: support dest_app_name, dest_app_id, and display_username

[scweber-cisco]

Summary

The OIDC Auth API documents three optional claims in the authorization request JWT that create_auth_url had no way to send:

• dest_app_name — user-facing application name, shown in Duo Mobile and surfaced as destination_name in the authentication log
• dest_app_id — long-lived unique application identifier, not shown to users
• display_username — username shown in the Duo Mobile "user" field for Push; defaults to the Duo username when omitted

All three are optional keyword arguments and are only added to the JWT when provided, so existing callers are unaffected:

create_auth_url(username, state, nonce=None, dest_app_name=None,
                dest_app_id=None, display_username=None)

Test plan

Three new cases in tests/test_create_auth.py, each asserting the exact encoded request JWT:

• both dest_app_name and dest_app_id
• display_username alone
• dest_app_name alone

The two pre-existing tests assert the full expected JWT payload, so they already guard against the new claims appearing when unset.

Full suite passes (80 tests) and flake8 is clean.

Also manually tested with the demo app. Passing dest_app_name to create_auth_url resulted in same value being echoed back in the auth response.

🤖 Generated with Claude Code