keycloak: investigate end_session_endpoint

[mdonadoni]

Keycloak/OIDC provides a way to end the Keycloak session when a user logs out from one of his applications, by means of the end_session_endpoint API endpoint. This is currently not used by REANA, neither for CERN SSO nor for Keycloak.

As an example, the API endpoint is https://auth.cern.ch/auth/realms/cern/protocol/openid-connect/logout for CERN SSO.

We should:

• investigate whether invenio-oauthclient supports this logout mechanism
• find out which would be the benefits of supporting this in REANA
• check what is the behaviour of Keycloak, in particular whether is it possible to log out only from REANA and not from all of the other applications authenticated through Keycloak (we are interested in the former)
• discuss how to proceed