Enhance KnoxSSO to Support Session Timeout and Logout

By extending the WebSSOResource in KnoxSSO to accept redirects with a session-state query param, we can provide hooks for handling session expiry/timeout and logout.

This will assume that a participating application redirects to a given session timeout or logout page which can be rewritten to or be configured to be the knoxsso endpoint with a session-state change query param.

We will then be able to determine how to handle each and to give the user a choice when appropriate.