Add Single Sign Out using OpenID Connect Session Management and Single Sign Out endpoint

Initial version that supports Single Sign-Out.

Prerequisites

- OpenID Connect 8.x-1.x-dev

- OpenID Connect patch from issue #2921095 applied.

Known issues & limitations

No automatic session renewal after SO session changes detected

OpenID Connect specifications suggest to try renewing the tokens with a prompt-less request to the auth server. However, we didn't like to alter too much for now. The patched solution does not try to refresh sessions after OP logout was detected. Instead the user will immediately be redirected to Drupal's <front> page.

Sign out race conditions

When Drupal initiated Single Sign-Out takes place (e.g. when the user logs out in Drupal) and Keycloak initiated Single Sign Out detection in Drupal is enabled, both mechanisms may try to log the user out and redirect to the start page.
The asynchronous in-page JavaScript requests (that check for OP initiated sign-outs) may recognize a terminated session even before Keycloak answered with a redirect to a RP initiated sign-out request (e.g. when the user logs out in Drupal). As both sign out mechanisms redirect to the front page, the user experience won't be much affected.

No automated testing

Merged KeycloakService into 8.x-1.x-dev and re-rolled the patch.

Will wait with merging single sign-out features, till there is feedback from the openid_connect maintainers about the supposed changes to its after authorization hook (issue #2921095), which our single sign-out heavily depends on.

Fixes some coding standard issues.

Re-rolled patch for current 8.x-1.x-dev version.

This is an interdiff to patch of issue #2920952.

If you like to enable single sign-out and groups mapping in the current 8.x-1.x-dev version (for testing purposes):
- apply the patch of issue #2921095 to the dev version of the openid_connect module,
- apply the groups mapping patch of issue #2920952 to the keycloak module dev version,
- then apply this interdiff to the keycloak module dev version.

Not yet production ready. The above branch still depends on https://www.drupal.org/files/issues/openid_connect-2921095-5.patch and will be merged to the module, once the openid_connect maintainers decided about this patch.