Add LTI 1.3 launch support and AGS grade passback alongside LTI 1.1

[Copilot]

BlockPy only handled LTI 1.1 launches and XML outcomes. This update adds LTI 1.3/OIDC launch handling and LTI Advantage AGS read/write grade support while preserving the existing LTI 1.1 flow.

• Launch flow

  • add LTI 1.3 login initiation handling with state/nonce management
  • verify id_token against configured issuer, client ID, deployment, and JWKS
  • normalize LTI 1.3 claims into the current session model so existing user/course provisioning paths continue to work

• Grade passback

  • detect LTI 1.3 launches from stored endpoint metadata
  • use AGS /scores and /results for score post/read operations
  • preserve LTI 1.1 XML outcomes for legacy integrations

• Data model compatibility

  • reuse existing lis_outcome_service_url and lis_result_sourcedid storage by encoding LTI 1.3 AGS context as structured JSON
  • avoid schema changes while keeping per-course and per-submission grade context intact
  • carry LTI 1.3 submission context through subsequent requests where the original form payload is no longer present

• Auth and role integration

  • thread LTI 1.3 platform configuration through auth and grading entrypoints
  • support URI-style LTI 1.3 role values in existing role checks
  • allow course/user loading to work with either LTI 1.1 or LTI 1.3 launch data

• Configuration

  • introduce documented LTI13_PLATFORMS registration for issuer, client, token, JWKS, and signing credentials
  • add JWT crypto support needed for launch validation and AGS client assertions

LTI13_PLATFORMS = [{
    "issuer": "https://canvas.instructure.com",
    "client_id": "YOUR_DEVELOPER_KEY_ID",
    "deployment_ids": ["YOUR_DEPLOYMENT_ID"],
    "auth_login_url": "https://canvas.instructure.com/api/lti/authorize_redirect",
    "auth_token_url": "https://canvas.instructure.com/login/oauth2/token",
    "jwks_url": "https://canvas.instructure.com/api/lti/security/jwks",
    "private_key_file": "/full/path/lti13_private_key.pem",
    "kid": "OPTIONAL_JWK_KEY_ID",
    "service": "canvas"
}]