refactor(sso): compute the app logout target once in the sso lookup

The previous commit wrote the same proxy-aware logout expression into
four javascript.js.j2 templates. The rule it encodes - sign out of
oauth2-proxy first when the app is proxy-gated, else go straight to the
provider - belongs where proxy-gating is already decided.

utils/roles/applications/services/sso.py gains logout_url(url,
is_proxy_gated) next to get_sso_config, with OAUTH2_SIGN_OUT_PATH as the
path constant; the rd value is quoted exactly as Jinja's urlencode
filter does it. The sso lookup exposes it as the logout_url term: it
renders OIDC through the templar, takes is_proxy_gated from the same
resolution, and refuses a context without OIDC. Prometheus, Checkmk,
Baserow and Jitsi now render lookup('sso', application_id, 'logout_url').

Behaviour is unchanged: the resolver tests pin the rd encoding against
jinja2's do_urlencode, and the lookup tests cover a proxy-gated app, an
OIDC-native app, a disabled SSO and a missing OIDC.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/utils/roles/applications/services/test_sso.py

@@ -2,11 +2,16 @@ from __future__ import annotations
 
 import unittest
 
+from jinja2.filters import do_urlencode
+
 from utils.roles.applications.services.sso import (
     get_sso_config,
     is_potentially_enabled,
+    logout_url,
 )
 
+KEYCLOAK_LOGOUT = "https://auth.example.org/realms/r/protocol/openid-connect/logout"
+
 
 def _apps(
     *,
@@ -203,5 +208,22 @@ class IsPotentiallyEnabledTests(unittest.TestCase):
         self.assertTrue(is_potentially_enabled(""))
 
 
+class TestLogoutUrl(unittest.TestCase):
+    def test_an_app_without_the_proxy_logs_out_at_the_provider(self):
+        self.assertEqual(logout_url(KEYCLOAK_LOGOUT, False), KEYCLOAK_LOGOUT)
+
+    def test_a_proxy_gated_app_signs_out_of_oauth2_proxy_first(self):
+        self.assertEqual(
+            logout_url(KEYCLOAK_LOGOUT, True),
+            "/oauth2/sign_out?rd=https%3A//auth.example.org/realms/r/protocol/openid-connect/logout",
+        )
+
+    def test_the_rd_encoding_matches_the_jinja_urlencode_filter(self):
+        self.assertEqual(
+            logout_url(KEYCLOAK_LOGOUT, True),
+            f"/oauth2/sign_out?rd={do_urlencode(KEYCLOAK_LOGOUT)}",
+        )
+
+
 if __name__ == "__main__":
     unittest.main()