Improve gateway parameter handling to properly match the protocol description (SSP-2167)

[ioigoume]

• Implements CAS gateway per spec, including an optional passive mode (disabled by default).
• When unauthenticated and non-interactive auth is not possible, we redirect to the exact service URL with no ticket, preserving its query string.
• renew disables passive.
• Tests added to cover all scenarios, including preservation of existing service query params.

[pradtke]

hmm . I guess I was expecting the change to look more like the below.

        if ($serviceUrl !== null && $gateway && !$this->authSource->isAuthenticated()) {
            return new RunnableResponse(
                [$this->httpUtils, 'redirectTrustedURL'],
                [$serviceUrl, []],
            );
        }

I suppose we could allow keeping the old behavior by using the enable_passive_mode flag in that if condition as well. I don't follow the need for most of the changes, like with gatewayTried. The current code base was already setting isPassive when it called login.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.67%. Comparing base (b0ac520) to head (3d953b1).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master      #53      +/-   ##
============================================
+ Coverage     66.63%   67.67%   +1.03%     
- Complexity      353      363      +10     
============================================
  Files            26       26              
  Lines          1190     1219      +29     
============================================
+ Hits            793      825      +32     
+ Misses          397      394       -3     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.