SSO fixes and improvements

[aidenfoxx]

Sorry for bundling things together. I can split them out if required.

• Fixes OIDC: refresh grant improperly handles new refresh_token #10233 (update refresh_token if one is provided in the refresh() call)
• Added ability to set custom authorization URL parameters
• Added ability to specify issuerUrl in OAuth2 flow (required when using OpenID)
• Added handling for if refresh_token is invalidated
  1. During login we trigger a refresh to verify the refresh_token validity
  2. On InvalidTokenException trigger the SSO authorization page with a prompt=consent to request a new refresh_token
  3. Fail if token continues to be invalid

[rijkvanzanten]

LGTM!