Returning http.DefaultClient can be harmful.

[seiyab]

Problem
Minimal reproduction of problem: https://go.dev/play/p/z-sitms7DpF
Returning http.DefaultClient, programmers can sometimes pollute global variable unintentionally. It's because http.DefaultClient is a pointer. Recently, a similar mistake caused a vulnerability https://pkg.go.dev/vuln/GO-2024-2618.

Description
Currently, function ContextClient() in internal package returns http.DefaultClient under some situation.

oauth2/internal/transport.go

Lines 21 to 28 in d0e617c

	func ContextClient(ctx context.Context) *http.Client {
	if ctx != nil {
	if hc, ok := ctx.Value(HTTPClient).(*http.Client); ok {
	return hc
	}
	}
	return http.DefaultClient
	}

Some functions that utilize internal.ContextClient(), like oauth2.NewClient(), can also return http.DefaultClient. Since http.DefautClient is a pointer, modifying returned default client cause change in global variable and possibly break entire application randomly.
I suggest returning a new instance &http.Client{}, that is same as a definition of http.DefaultClient.