Security: Strengthen Google ID token issuer validation

[Macktireh]

Description

This PR fixes a security vulnerability in the Google ID token validation. The current implementation uses a substring match (in operator) which could potentially allow tokens from malicious issuers like malicious-accounts.google.com.evil.com.

Vulnerability Explanation

Current vulnerable code:

if "accounts.google.com" not in id_info.get("iss", ""):

Problem: This check is too permissive and could match:

• ✅ https://accounts.google.com (valid)
• ✅ accounts.google.com (valid)
• ❌ fake-accounts.google.com.attacker.com (INVALID - but would pass!)
• ❌ malicious-accounts.google.com (INVALID - but would pass!)

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
src/simplesocialauthlib
__init__.py	0	0	100%
abstract.py	37	3	92%	73, 89, 105
exceptions.py	14	0	100%
types.py	15	0	100%
utils.py	24	14	42%	26–39
src/simplesocialauthlib/providers
__init__.py	21	11	48%	7–8, 14–15, 19–25, 29–30, 34–35
github.py	43	13	70%	59–76, 81–89
google.py	50	16	68%	78–92, 97–123
TOTAL	204	57	72%

Tests	Skipped	Failures	Errors	Time
11	0 💤	0 ❌	0 🔥	1.086s ⏱️