Add client name to session and redirect after logout only for active client in multiclient environment

Problem/Motivation

In environments where multiple OpenID Connect clients (each with end session endpoints defined) are enabled with the "Logout from identity provider" setting, users may be redirected to the incorrect identity provider after logging out. This occurs because:

• Users can have multiple connected accounts in a multiclient setup.
• The system queries all connected accounts based on the username, which doesn't specify the active account used for login.
• The redirectLogout() function lacks information about which account was used for the login session.

If the last returned client name does not correspond to the account used for login, the user is redirected to the wrong identity provider, and the session is not properly terminated at the identity provider's end.

This issue is acknowledged in the redirectLogout() function with the following @todo note:

    // @todo The fact that the user has a connected account doesn't necessarily
    //   mean that it was used for the login. This info should probably be kept
    //   in the session.

Steps to reproduce

1. Configure more than one OpenID Connect client.
2. Enable "Logout from identity provider" and "Automatically connect existing users" settings.
3. Define an end session endpoint for each enabled client.
4. Log in using the first client and then log out.
5. Log in using the second client and then log out.
6. Log in using the first client and then log out.

Users may be redirected to the incorrect identity provider, and the session may not be terminated at the identity provider's end.

Proposed resolution

• Store the client name in the session to track which client was used for login.
• Ensure logout operations are performed only for the connected account used for login.