[WS-Federation] Implement signout cleanup

[leastprivilege]

http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html#_Toc223175005

When a sign-out clean-up GET is received at a realm, the realm SHOULD clean-up any cached information and delete any associated artifacts/cookies. If requested, on completion the requestor is redirected back to requestor's IP/STS.

It is very similar to OIDC front-channel signout (/signout-oidc) - when the IdP receives a sign-out, it notifies all RPs in the current session by sending them a signout cleanup message. The RPs then delete their own local state (e.g. authentication cookie).

[Eilon]

Seems important to have this per @vibronet.

[leastprivilege]

I am so happy that Vittorio agrees with me...

[Tratcher]

AAD appears to support this, you can define a Logout Url in the portal. However I cannot find the right IDP endpoint to trigger the single signout.