OAuth2 code flow: Missing state param when user is asked to authorize

When user is first time requested to authorize oauth

the state parameter is not returned in the callback

There was similar issue https://issues.redhat.com/browse/PROJQUAY-3139, but it seems to be fixed only when user already authorized and is not redirected into "Authorize" page.

I don't know the quay codebase, but it looks like state param is missing here https://github.com/quay/quay/blob/master/endpoints/web.py#L728 so Authorize page does not have it at all and can't send it back to callback.