Draw an authorization request's random values (sign-in pages)

The draw a page that holds no SparkVault credential takes its sign-in values from: an authorization request's PKCE verifier, state and nonce, which the browser SDK's signIn() and the hosted sign-in pages draw here. Every call first spends one draw of its network address's hourly budget, before anything is read, counted whichever account the path names, and the call past it is refused 429 with nothing drawn. A browser on an origin the account has not verified is then refused, with nothing drawn.