Description

Improves the initial OIDC RP-Initiated Logout flow with several enhancements:

• Bearer-token-based logout: The logout endpoint now reads token data directly from the CM Authorization Bearer header rather than requiring the client to pass an id_token_hint query parameter. This avoids a DB lookup that would fail after token refresh (since the credential value changes on refresh but the patron's bearer token still holds the old value).
• Stored id_token for logout hint: The raw ID token JWT is now persisted in the credential JSON at authentication (and on refresh), so it can be used as id_token_hint in RP-Initiated Logout requests.
• Token revocation support (RFC 7009): Added a new optional revocation_endpoint configuration field. On logout, the OAuth refresh token is revoked best-effort to prevent silent re-authentication at the IdP after local CM session invalidation.
• Graceful fallback: If the provider does not support RP-Initiated Logout, or if no stored id_token is available (credentials predating this feature), logout completes locally and redirects to success without an IdP round-trip.
• Logout link in authentication document: If the provider supports any logout mechanism, a "rel": "logout" link is now included in the authentication document returned to clients.
• Authentication manager caching: get_authentication_manager() now caches the OIDCAuthenticationManager instance for the provider's lifetime, preventing repeated OIDC discovery document fetches on every authenticated request.

Motivation and Context

• Fixes and extends the OIDC logout flow introduce with the initial OIDC implementation. The original implementation required clients to pass an id_token_hint, which was fragile after token refresh (the stored credential changes but the patron's bearer token does not). This rework makes logout more reliable and self-contained, using only the bearer token already required for authenticated requests.

• Also addresses a performance issue where the OIDC discovery document was being fetched on every request to get_authentication_manager().

[Jira PP-3726]

How Has This Been Tested?

• Test pass locally.
• CI tests passed.

Checklist

• I have updated the documentation accordingly.
• All new and existing tests passed.