Link to DID webpage only works if already authenticated due to callbackUrl decoding

Description

Following links directly to a DID (if someone copied the link from their browser to share) only works if the browser is already authenticated against Rucio. If the user clicking the link is not already authenticated, the DID name path component (which is URI-encoded) is decoded somehow during the 307 redirects and hence the resulting callbackUrl passed to the login page is invalid. This causes the link to show a 404 after the login flow is completed.

Following images show the path component being directly encoded before hitting the 307 redirects from Rucio to perform login. The first screenshot shows the link in the request before the first redirect to the /api/auth-endpoint.

The second screenshot show the decoded component and hence invalid URL in the callbackUrl parameter.

Steps to reproduce

1. Ensure you are logged out of any Rucio instance web API.
2. Follow a link to a DID webpage, such as:

https://xxx.rucioit.cern.ch/did/page/<scope>/<uri-encoded-name>

3. Follow the login prompts.
4. Get the 404 error due to invalid callbackUrl

Rucio Version

Client: WebUI, Server: 39.4.0

Additional Information

No response

Start by reproducing the logged-out DID link flow and tracing the 307 redirects to the /api/auth endpoint, focusing on how the URI-encoded DID name enters callbackUrl. Confirm the fix by completing login from a copied DID link without receiving a 404, while preserving the encoded path.