* fix(oidc): bind logout URLs to the current session (forced-logout CSRF)
Logout URLs were signed only over the redirect target and a timestamp, so any
valid, unexpired logout URL would clear whoever's cookies followed it. The
logout signature now also covers the caller's sqlpage_auth cookie, so a logout
URL only logs out the session it was issued for. Generation and verification
select the same cookie (the last of any duplicates, matching how RequestInfo
merges them) so the check stays consistent.
* style: run cargo fmt on the logout cookie test
Ophir LOJKINE
b893455439