Reserves a nonce for a native SSO sign-in attempt.

The web flow gets its nonce from M:Roblox.Authentication.Api.Controllers.V1.ExternalIdentitiesGatewayController.OAuthInit(System.Int64,System.Threading.CancellationToken), which native clients never call because they have no authorization redirect. They call this instead, pass the nonce to the provider SDK, and post the resulting id_token to /access.

The client must pass this value to the SDK verbatim. Both providers treat the nonce as an opaque string and echo it into the id_token unchanged, and redemption looks the value up as issued. The SHA256(nonce) convention seen in Apple examples belongs to Firebase, which hashes on its own side before comparing; hashing here would make the lookup miss.