Build a Quarkus web app that uses Pushed Authorization Requests with Keycloak, keeps OAuth parameters out of the browser URL, and hardens your login flow with one property.