fn validate_verifier(v: &str) -> Result<(), PkceError>
Strict RFC 7636 validator: length 43–128 and only unreserved characters.
Unreserved: ALPHA / DIGIT / “-” / “.” / “_” / “~”