security: fix CVE-2025-22868

[thatnealpatel]

This is a PRIVATE issue for CVE-2025-22868, tracked in http://b/392867809 and fixed by https://go-internal-review.git.corp.google.com/c/oauth2/+/1920.

/cc @golang/security and @golang/release

[rolandshoemaker]

Fixed by https://go.dev/cl/652155.