Add session-aware external SSO support

[n35k3nd1r]

Summary

• add cookie-based Django session authentication for externally authenticated Pulp deployments
• keep the existing HTTP Basic authentication flow as the default
• add configurable external login redirects with route-preserving next parameters
• detect the authenticated session user through the browsable users API without persisting a synthetic identity
• post Django logout with CSRF protection and always clear local UI authentication state

Motivation

Pulp can authenticate API requests through Django sessions and external authentication backends, but Pulp UI currently assumes HTTP Basic credentials stored in browser storage. This prevents the stock UI from working cleanly with SSO even when the backend authentication succeeds.

The change makes session authentication opt-in through UI_EXTERNAL_LOGIN_URI. Deployments that leave this setting empty retain the existing Basic authentication behavior.

Implementation details

• session cookies are sent with same-origin API requests
• the authenticated username is read from the header of /pulp/api/v3/users/?limit=1
• task permissions are not used as an authentication probe
• session identities and passwords are never persisted in local or session storage
• logout posts to Django's logout endpoint and guarantees local cleanup
• unauthorized API responses expose the configured external login link

Validation

• existing repository release workflow completed successfully, including lint and test steps
• Cypress coverage added for session restoration, stale cached identity rejection, and logout cleanup
• built from the generated release archive and deployed against Pulpcore 3.114.2
• validated logout followed by first-pass Microsoft Entra ID login without a manual refresh
• verified that HTTP Basic remains the default when UI_EXTERNAL_LOGIN_URI is unset