examples/service-whoami-flask: Fix return types in oauth_callback

In my testing, Flask 3.0.0 doesn't accept returning only an integer
(as an error code) in a handler.  A (content, status) tuple does
work.  I don't know if this is a recent change, or if this has always
been broken, but the tuple return should be good for older Flask
versions as well.

examples/service-whoami-flask/whoami-flask.py

@@ -56,14 +56,14 @@ def whoami(user):
 def oauth_callback():
     code = request.args.get('code', None)
     if code is None:
-        return 403
+        return "Forbidden", 403
 
     # validate state field
     arg_state = request.args.get('state', None)
     cookie_state = request.cookies.get(auth.state_cookie_name)
     if arg_state is None or arg_state != cookie_state:
         # state doesn't match
-        return 403
+        return "Forbidden", 403
 
     token = auth.token_for_code(code)
     # store token in session cookie