chore(auth): replace axios with fetch in third-party auth routes

[toufali]

Because

• axios is a recurring source of security advisories. Continues the migration to native fetch (FXA-13427); this PR covers the auth-server third-party (Google/Apple) auth routes.

This pull request

• Replaces axios with native fetch in the Google/Apple OAuth token-exchange POSTs (linked-accounts.ts) and the public-key GETs (third-party-events.ts).
• Migrates linked-accounts.spec.ts off jest.mock('axios') to global.fetch stubs, including non-ok and Content-Type coverage.
• Adds third-party-events.spec.ts covering the previously-untested public-key fetch functions.

Issue that this pull request solves

Closes: FXA-13427 (auth routes)

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

Other information (Optional)

axios dep remains in fxa-auth-server's package.json for now — customs.js and scripts/google-events-cli.js still use it.

[toufali]

Keeping the request identical to what axios previously sent: turn the plain object into a JSON body with application/json header.

[toufali]

Keeping the request identical to what axios previously sent for Apple: form-encoded instead of JSON (application/x-www-form-urlencoded).

Note: this header added to the call is mandatory - fetch won't add automatically. Test added so we can catch it if it ever gets dropped.

[Copilot]

Pull request overview

This PR continues the auth-server migration away from axios by switching third-party (Google/Apple) auth route HTTP calls to native fetch, and adds/updates unit tests to cover the new fetch-based behavior.

Changes:

• Replace axios with fetch for Apple/Google public-key retrieval in third-party-events.ts.
• Replace axios with fetch for Google/Apple OAuth token exchange in linked-accounts.ts.
• Update/add Jest coverage by stubbing global.fetch, including new tests for third-party public-key fetchers.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
packages/fxa-auth-server/lib/routes/utils/third-party-events.ts	Migrates Apple/Google public-key retrieval from axios to fetch and adjusts response parsing/error handling.
packages/fxa-auth-server/lib/routes/utils/third-party-events.spec.ts	Adds unit tests for the public-key fetch functions using global.fetch stubs.
packages/fxa-auth-server/lib/routes/linked-accounts.ts	Migrates Google/Apple token exchange POSTs from axios to fetch with explicit res.ok checks and JSON parsing.
packages/fxa-auth-server/lib/routes/linked-accounts.spec.ts	Removes axios mocking and updates tests to stub global.fetch, including non-OK response coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vbudhram]

@toufali Went through third party auth locally and works,

[vbudhram]

Thanks for adding!