Session management

[lullis]

Fixes #1130

Description of the Change

Implementation of OIDC Session Management. This PR:

• Adds some settings variables to enable OIDC Session Management
• Adds checks to validate OIDC Session Management settings - if it is enabled, then Django will require a OIDC_SESSION_MANAGEMENT_DEFAULT_KEY to be present.
• Adds the session_state parameter to the parameters given to the end user client upon succcessful authorization. The session state is calculate by a salted hash combination of client id, origin and "OP user agent state", which for the intents of session management is itself just a hashed value of the session key for authenticated users, and OIDC_SESSION_MANAGEMENT_DEFAULT_KEY if the user is not authenticated. This is enough for the OP to indicate whether the end user session has changed (logged in, logged out)
• Add a OIDCSessionManagementMiddleware that sets a cookie with the value of "OP user agent state"
• Adds a SessionIFrameView endpoint for the "OP IFrame"

Checklist

• PR only contains one change (considered splitting up PR)
• unit-test added
• documentation updated
• CHANGELOG.md updated (only for user relevant changes)
• author name in AUTHORS

[dopry]

@lullis Thank you for working on this. I've only given it a cursory review, but it looks like a great start. It'll probably be late next week before I can look at this closely. Ping me again if I don't manage to get you a review by next Friday.

[Qup42]

@lullis I'm quite busy at the moment. I think that I should be able to have a look at this in the next ~3 months. Do please remind me if I forget it.

[lullis]

@Qup42, just pinging to remind you about this PR.

[dopry]

@lullis any guidance on testing procedures for this PR?

[lullis]

@dopry I got a small app going to test these features at https://codeberg.org/raphael/oidc-client-testbed.

I won't make any strong claims about its overall quality (I relied on Cursor to generate a lot of the boilerplate and the vue components), but I did check the actual functionality and it works well enough to check the session frame part.