Make OAuth2Session picklable (oauthlib #849)

[apoorvdarshan]

Fixes oauthlib/oauthlib#849.

Problem

OAuth2Session cannot be pickled, so it can't be sent across processes (e.g. multiprocessing, ProcessPoolExecutor):

>>> import pickle
>>> from requests_oauthlib import OAuth2Session
>>> pickle.dumps(OAuth2Session(client_id="abc"))
_pickle.PicklingError: Can't pickle local object 'OAuth2Session.__init__.<locals>.<lambda>'

The cause is a lambda assigned in __init__:

# Ensure that requests doesn't do any automatic auth. See #278.
self.auth = lambda r: r

Lambdas defined inside a method aren't picklable.

Fix

Move the no-op auth handler to a module-level function so instances remain picklable. Behavior is identical — it still returns the request unchanged, which is what disables requests' automatic auth (e.g. from .netrc, per #278).

def _no_op_auth(request):
    return request
...
self.auth = _no_op_auth

The maintainer asked for a PR with a test in oauthlib/oauthlib#849.

Testing

• Added OAuth2SessionTest.test_pickle: every client type pickles/unpickles, and the restored session's auth still returns the request unchanged. It raises PicklingError on main and passes with this change.
• The OAuth2 test suites pass (36 passed). Two unrelated items in this environment are pre-existing and not touched by this change: tests/test_compliance_fixes.py fails to collect without the optional requests_mock dependency, and tests/test_core.py::OAuth1Test::testCanPostBinaryData fails on main as well (OAuth1, binary body).
• ruff is clean on the changed files. Added a HISTORY.rst entry.

---

Disclosure: this change was prepared with the assistance of an AI tool (Claude Code). I reproduced the issue, implemented and verified the fix and test, ran the suite and linter, and take responsibility for the contribution and will respond to review feedback personally.