Consider OIDC Back-Channel favoring logout_token over CSRF

[jzheaux]

The current OIDC back-channel logout support saves the end-user's CSRF token to use in a self-logout call when the back-channel request comes from the authorization server.

This adds more information to OidcSessionInformation than may be necessary. Instead, I think it would also work to send the logout_token in place of the CSRF token.

The upside is a simpler contract and simpler configuration. The possible downside is the logout token is validated multiple times, once for each session being invalidated.

[jzheaux]

Waiting on #14510

[jzheaux]

Given the feedback in #15227, I think that's enough to consider adding this without waiting for #14510.