Someone Else's URL Scheme

Your iOS app starts a login in the system browser and receives the authorization code on a custom URL scheme. A malicious app registers the same scheme and receives the code first. Which mechanism stops that code from being redeemed?

The nonce claim in the ID token, which the app checks to reject a response it did not initiate itself

PKCE: the app sends a hash of a random verifier to start the flow and the verifier itself at exchange, so a code without the verifier is useless

The state parameter, which the app generates before the redirect and compares on return to prove the response belongs to the request it started

Shipping the client secret inside the app binary, so the token endpoint can authenticate the exchange and refuse any request from an app that cannot present it