fix(sso): use query response mode so the Entra ID callback keeps its session

[marevol]

Problem

getAuthUrl() asked Entra ID for response_mode=form_post:

+ "/oauth2/v2.0/authorize?response_type=code&scope=...&response_mode=form_post&redirect_uri="

so the authorization response comes back as a cross-site POST from
login.microsoftonline.com.

Fess sets SameSite=Lax on the session cookie — tomcat.sameSiteCookies = lax in
tomcat_config.properties, applied to the Tomcat CookieProcessor in FessBoot. A Lax
cookie is not sent on a cross-site POST. And because the attribute is set explicitly,
Chrome's two-minute "Lax + POST" grace period does not apply either — that grace period only
covers cookies with no SameSite attribute at all.

So on the callback:

1. request.getSession(false) returns null
2. the stored state / nonce are unreachable, so the response can never be validated
3. getLoginCredential() falls through to ActionResponseCredential → redirect to the
   authorization endpoint → the loop repeats forever

The default value of tomcat.sameSiteCookies was only added recently (#3136). Before that the
attribute was unset, so the grace period kept form_post working — this is a regression rather
than a long-standing bug.

Fix

Ask for response_mode=query. With response_type=code the response is then a top-level
GET navigation, which does carry a Lax cookie. query is also the default response mode for
the authorization code flow, so nothing about the app registration changes — response_mode is
chosen by us in the authorization request, not configured on the Entra ID side.

containsAuthenticationData() now accepts GET as well as POST, so a deployment that already
set tomcat.sameSiteCookies=none and relies on form_post keeps working.

Stop bouncing a session-less callback back to the IdP. That is what turned a missing cookie
into an infinite redirect. It now logs a warning naming the likely cause and returns null, so
SsoAction shows the SSO login error and goes to the login page once.

The comment on tomcat.sameSiteCookies said "Lax keeps OAuth/OIDC redirects working", which is
true for redirect-based callbacks but not for POST ones. Reworded to say which setups need
none — SAML's HTTP-POST binding has the same constraint.

On putting the code in the query string

The authorization code is single-use, short-lived, and cannot be redeemed without the client
secret, which is why query is the standard mode for a confidential client. #3213 stops the code
being written to the debug log.

Tests

EntraIdAuthenticator's unit test class, 6 new tests:

• test_getAuthUrl_requestsQueryResponseMode / ...OnV1Endpoint — asserts response_mode=query,
  no form_post, and that response_type, state and nonce are unchanged
• test_containsAuthenticationData_acceptsQueryModeCallback — GET with code
• test_containsAuthenticationData_acceptsFormPostCallback — POST still accepted
• test_containsAuthenticationData_acceptsErrorCallback — GET with error
• test_containsAuthenticationData_ignoresRequestWithoutArtifacts — a plain visit to /sso still
  starts a fresh login

All 4 behavioural ones failed before the change.

Tests run: 108, Failures: 0, Errors: 0, Skipped: 0

(the whole org.codelibs.fess.sso package, including the OIDC and SAML authenticator tests)