Cognito authorize loop demonstrationbroken

Reproduces the redirect loop pattern seen in customer HARs: repeated /oauth2/authorize requests that never settle, with a token endpoint error on each pass. The loop is capped so it cannot run away.