Implement OIDC back-channel logout

Steps

1. Register a backchannel_logout_uri on your relying party client registration; this must be an HTTPS URL that Cognito, Okta, or another OP can reach directly from its backend.
2. Advertise back-channel logout support in your RP's metadata and confirm the OP supports it by checking the backchannel_logout_supported and backchannel_logout_session_supported claims in the OP's discovery document.
3. When your endpoint receives a POST from the OP, extract the logout_token from the request body (application/x-www-form-urlencoded), verify its signature using the OP's JWKS, and validate the required claims: iss, aud, iat, jti, and the events claim containing http://schemas.openid.net/event/backchannel-logout.
4. Confirm the logout_token does not contain a nonce claim (its presence makes the token invalid per the spec) and that jti has not been seen before within the token's validity window.
5. Using the sub or sid claim from the logout token, invalidate all sessions for that user or that specific session in your application.
6. Return HTTP 200 (or 204) synchronously once session invalidation is complete; return 400 if the token is invalid; the OP may retry on non-2xx responses.