Add support for RP-Initiated logout

[tamasmak]

Description

• Add logout method and its implementaion to the VaadinAuthContext to handle the single sign-off
• Add logout redirect url to the properties
• Modify the logout button in the Profile view

Fixes #24

Missing:

• Logout redirect url handling
• Finalize documentation
• Tests

Type of change

• Bugfix
• Feature

[CLAassistant]

All committers have signed the CLA.

[heruan]

There was some code shared with another branch which led to conflicts when merging with main, I'm converting this to draft until they're fixed.

[heruan]

The PR is now ready for review. On top of the previous commits, it now has:

• A default implementation of VaadinAuthContext::logout which takes care of logout handlers
• Auto-configuration for logout and exception handling
• Inline comments to explain each step of auto-configuration
• JavaDoc on new methods and classes
• Tests to ensure logout handlers are set and executed

[knoobie]

Inline comments to explain each step of auto-configuration

Is it planned to let this module stay open source? Or is it planned to change it later to closed source like done with the addition of the legacy components? I can totally understand the reasoning behind the license / payed model. But I personally think that security related code should stay open source to find and report security problems instead of forcing people to decompile it to find bugs or security holes. This comment comes from the fact that inline comments are used, which in turn are missing if close source is used and the source files aren't distributed.

[heruan]

Is it planned to let this module stay open source? Or is it planned to change it later to closed source like done with the addition of the legacy components?

Hey @knoobie, thanks for the question! Current plan is to keep the sources open, although using the add-on or parts of the code will require a commercial license.

[knoobie]

the add-on or parts of the code will require a commercial license

That is totally valid! Thanks for the feedback, really appreciated!

[DiegoCardoso]

Initial comments.

[DiegoCardoso]

The changes look good to me.

I was able to configure and see that the user's session is correctly removed when I was using it with Keycloak.
With Okta, I wasn't able to make it work, but because it fails with a CORS error when trying to reach the provider's API. I tried to configure it there, but not successfully. Judging by the format of the request, I believe it should work when properly configured.