Gateway login adds an account-confirmation step and safer OAuth revocation

What

• Signing in through a custom or enterprise login gateway now shows a new "confirm account" step after sign-in completes: it displays the signed-in (truncated) email and asks you to confirm it's the right account, with "Yes, continue"/"No, go back" options, before organization settings are applied to the machine; Escape is blocked while it's saving.
• OAuth discovery now checks that an advertised revocation_endpoint is on the same origin as the gateway URL before trusting it; otherwise it's ignored and a warning is logged, meaning sign-out won't revoke the token in that case.
• When a valid revocation_endpoint is advertised, it's now stored on the persisted auth record along with the account's email, and sign-out sends an RFC 7009 revocation request for the bearer token (and the refresh token if one was issued). Accounts that signed in before this existed get their metadata re-checked so revocation still works for them. A new PROJECTS_SCOPES_REGISTERED OAuth scope flag is also tracked, alongside the existing plugins scope flag.

Why

This reduces the chance of applying an organization's settings to the wrong account, and makes sign-out actually invalidate tokens with the identity provider instead of just discarding them locally, while guarding against a malicious or misconfigured revocation endpoint.