User redirected to homepage if not SAML authenticated while Drupal authenticated

Problem/Motivation

We ran into a bug where users are redirected to the homepage if their SAML session has expired in SimpleSAMLphp while their Drupal session has not.

This is especially problematic in a path-based multisite environment since the user gets redirected to the domain homepage and as a result ends up on a different website (e.g. if they try to access https://example.com/mysite/mypage then they are redirected to https://example.com).

Steps to reproduce

Manually expiring a SAML session is tricky so let's use a local Drupal account (user 1) to simulate the case where as SAML session has expired whereas a Drupal session has not.

1. Enable and configure simplesamlphp_auth
2. Go to /admin/config/people/simplesamlphp_auth/local
1. Check box Allow authentication with local Drupal accounts
2. Set field Which users should be allowed to login with local accounts? to 1
3. Authenticate locally as user 1 (e.g. execute drush user:login) ; this creates a session in Drupal which has no corresponding SAML session
4. Disallow local authentication: drush -y config:set simplesamlphp_auth.settings allow.default_login false --input-format=yaml
5. Load any page of your website - say, https://example.com/mysite/mypage
6. Expected result: You get logged out however the page you requested (https://example.com/mysite/mypage) still loads and renders as an anonymous user
7. Actual result: Your get logged out and are redirected to the domain homepage i.e. https://example.com

Proposed resolution

The module includes an event subscriber SimplesamlSubscriber.php that fires on all requests and checks the authentication status of the user. This includes some logic that redirects to / when the user:

1. Has a valid Drupal session (is not anonymous)
2. Has no SAML session
3. Is not allowed to sign in locally

Instead of redirecting the user to / I think it would be best to redirect to the current page, as was the case in Drupal 7. Indeed in Drupal 7, when the conditions above are met, the module logs out the user by calling user_logout() which itself calls drupal_goto() which redirects to the current path.