fix(security): scope logout invalidation keys to the middleware instance

Back-channel logout keys for sub, sid and jti had no issuer or client
in them, in a cache shared by every instance. A logout for user u1 in
one realm logged out u1 in another, and an equal jti in two realms
looked like a replay. Keys now carry the instance prefix. An instance
without a prefix keeps the old key.

logout_key_scope_test.go

@@ -0,0 +1,18 @@
+package traefikoidc
+
+import "testing"
+
+func TestSessionInvalidationKeyScopedPerInstance(t *testing.T) {
+	a := &TraefikOidc{tokenCache: &TokenCache{}}
+	b := &TraefikOidc{tokenCache: &TokenCache{}}
+	a.tokenCache.SetNamespace("https://kc/realms/a|c|c")
+	b.tokenCache.SetNamespace("https://kc/realms/b|c|c")
+	for _, kind := range []string{"sub", "sid", "jti"} {
+		if a.buildSessionInvalidationKey(kind, "u1") == b.buildSessionInvalidationKey(kind, "u1") {
+			t.Errorf("%s key shared across issuers", kind)
+		}
+	}
+	if got := (&TraefikOidc{}).buildSessionInvalidationKey("sub", "u1"); got != "session_invalidation:sub:u1" {
+		t.Errorf("namespace-less key changed: %q", got)
+	}
+}