OAuth2 filter: OpenID Connect Back-Channel Logout

*Title*: *OAuth2 filter: OpenID Connect Back-Channel Logout*

*Description*:

The Envoy [OAuth2 filter ](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/oauth2_filter) supports OIDC authentication by specifying the `openid` scope in the `auth_scopes`, but currently lacks Single LogOut(SLO) support.

The OAuth2 filter currently only supports local logout via the `signout_path` in its configuration. Upon invoking `signout_path`, the OAuth2 filter clears the local session cookies from the user agent, but does not terminate the user's login session with the OP and logout from other RPs.

This behavior poses the following issues:
* The local logout does not effectively work. Even after a local logout, when an end user attempts to access a protected URL again, they can do so after just a few redirects in their browsers, bypassing the need for re-authentication with the OP. This occurs because the OP user session is still valid and active, so the OP authentication process won't prompt for user credentials.
* User can't logout from all RPs.

Implementing support for [OpenID Connect Back-Channel Logout v1.0 Spec](http://openid.net/specs/openid-connect-backchannel-1_0.html) in the OAuth2 filter would offer significant benefits. This feature would enable logout across all relying parties (RPs), ensuring comprehensive session termination in OIDC environments..

[optional *Relevant Links*:]

- [OpenID Connect Back-Channel Logout v1.0 Spec](http://openid.net/specs/openid-connect-backchannel-1_0.html)
- [Envoy Gateway OIDC](https://gateway.envoyproxy.io/docs/tasks/security/oidc/)
- https://github.com/envoyproxy/envoy/issues/21982

Alternatives:

[OpenID Connect Session Management v1.0 Spec](http://openid.net/specs/openid-connect-session-1_0.html) and
[OpenID Connect Front-Channel Logout v1.0 Spec](http://openid.net/specs/openid-connect-frontchannel-1_0.html) can also be used for SLO.

@arkodg @missBerg @loewenstein