Add post_logout_redirect_uri support and add test

[nuwang]

closes: #21275

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[ahmedhamidawan]

Just added a little commit that reuses the existing addSearchParams utility for constructing the logout URL.

As for the rest, looks fine to me, however, I haven't been able to test out the entire flow locally with an example.

[dannon]

The old client flow called /user/logout first, so the Galaxy session was already dead before attempting /authnz/logout. Now when OIDC is enabled only /authnz/logout is called — if that request fails, the server-side session survives. Acceptable tradeoff or worth a fallback?

The redirect_uri → post_logout_redirect_uri rename is correct per spec — do you know if any non-standard OIDC providers out there relied on the old param name? Might be worth a release note if so.

[nuwang]

@dannon The intent was indeed to invalidate the server side session as well. Isn't this call sufficient? trans.handle_user_logout(logout_all=asbool(logout_all))

Not aware of anyone relying on redirect_uri, but no harm in a release note I suppose.

[mvdbeek]

There's a conflict here

[mvdbeek]

Pushing the milestone, freeze is tomorrow