fix: implement id token hint on RP-Initiated logout

[jnfrati]

Overview

Hello again! Thanks to all the Dex team for taking the time to review my contributions ❤️

The purpose of this PR is to introduce the id_token_hint when redirecting to upstream on RP-Initiated logout, while testing sessions we encountered the issue that some OIDC (e.g Pocket-id, Authentik) providers force-require the id_token_hint to be added when provided a post_logout_redirect_uri, this means that the chain RP -> OP(Dex) -> OP(Pocket-id) gets broken due to Dex not sending that extra parameter.

Even though the current implementation of Dex is not "broken" as it's compliant with the specification, having this extra id_token_hint in the URL makes integration easier when working with a wide variety of third party services. Still, I understand that the intention might not be to send the id_token_hint always, so happy to apply any recommended approach on how to "flag" when to send this or not 🙌

What this PR does / why we need it

This PR introduces:

• A new field AuthSession.ConnectorData []byte
• Adds logic to store the id_token received from upstream during login under AuthSession.ConnectorData
• Implements logic to add the query parameter id_token_hint in case connectorData is provided to LogoutCallbackConnector.LogoutURL, worth mentioning that:
  • The id_token_hint is added if it's present in the connectorData, meaning it does not depend on whether the post_redirect_logout_uri is present or not.
  • This is only implemented on oidc connector

This enables a much smoother integration with OIDC providers that require the id_token_hint to validate the identity of the requesting party.

Tests introduced

• TestLogoutURL: covers IDToken present/absent, malformed connector data, and hint emission without post_logout_redirect_uri.
• TestTryUpstreamLogoutPrefersSessionConnectorData: verifies precedence of auth-session data over offline-session data, plus fallback behavior.
• storage/conformance testAuthSessionCRUD now asserts ConnectorData round-trips through both create and update.

Special notes for your reviewer

My assumption on this PR is that the logout process is only done if sessions exist, meaning that there's a higher chance of finding the id_token on the AuthSession.ConnectorData than in the OfflineSession object. This is why in logout, the auth session takes precedence over the offline session, but please let me know if this is a correct assumption!