[PLT-3581] Add configurable sign-out URL via --sign-out-url / OAUTH2_PROXY_SIGN_OUT_URL

[majimenez-stratio]

Summary

• The --sign-out-url flag was already registered in options.go but never wired to any struct field — it was effectively dead code.
• This PR connects it end-to-end so deployments can override the provider's default sign-out redirect URL without changing OAUTH2_PROXY_SIS_ROOT_URL.
• Fixes a bug where existing query params in the sign-out URL (e.g. ?appId=5784) were dropped when appending the rd redirect parameter.
• Needed for non-standard IdP logout flows (e.g. Autentica/REDSARA) where the IdP exposes a proprietary logout endpoint instead of OIDC RP-Initiated Logout.

Changes

File	Change
pkg/apis/options/providers.go	Add SignOutURL string field to Provider struct
pkg/apis/options/legacy_options.go	Add SignOutURL to LegacyProvider with flag:"sign-out-url" + map in convert()
providers/providers.go	Parse SignOutURL from config into ProviderData.SignOutURL
providers/sis.go	Use redirect.Query() instead of url.Values{} to preserve existing query params
providers/sis_test.go	Add TestSISProviderGetSignOutURL covering query param preservation

Usage

# env var
OAUTH2_PROXY_SIGN_OUT_URL: "https://autentica.redsara.es/Autentica/logout?appId=5784"

When set, after clearing the session cookie oauth2-proxy redirects the browser to this URL (preserving any existing query params) instead of <SIS_ROOT>/logout.

Test plan

• Deploy with OAUTH2_PROXY_SIGN_OUT_URL unset → logout behaviour unchanged
• Deploy with OAUTH2_PROXY_SIGN_OUT_URL=https://autentica.redsara.es/Autentica/logout?appId=5784 → browser redirects to Autentica on sign-out with appId param intact
• go test ./providers/ -run TestSISProvider passes

Relates to: PLT-3581 (https://stratio.atlassian.net/browse/PLT-3581)

🤖 Generated with Claude Code