Support OIDC RP-initiated logout

[jlehtoranta]

Add support for OIDC RP-initiated logout as defined in https://openid.net/specs/openid-connect-rpinitiated-1_0.html:

• Track OIDC/OAuth2 login type, tokens and authentication data on session level
• Keep session level data synced when using a login cookie (remember option)
• Handle OIDC/OAuth2 logouts on an authentication source specific endpoint
• Redirect to the OIDC end_session_endpoint, if it exists in the provider configuration
• Fallback to local logout only
• Be verbose about external logout errors
• Use a callback endpoint for maintaining state between Gitea and an OIDC provider

Fixes #14270

---

Additional notes:

• Tested with Keycloak (OIDC) and Github (OAuth2). Thorough testing with other IdPs and server setups is needed
• There are most likely some (small) merge conflicts with Support SAML authentication #29403 as these PRs modify partly the same code
• An additional PR is required for supporting OIDC back-channel (or front-channel) logout. I.e. your session in Gitea will still remain logged in, if you logout from your IdP elsewhere
• Tracking external logins on session level by using ExternalAuthTokens makes it easier to implement OIDC back-channel or front-channel logout support in the future

[lunny]

Since it's a big change for the user system, I think we need more time to discuss and have a whole design about the user system.