oidcc-rp-initiated-logout: Avoid use of ';' in states

This test

https://www.certification.openid.net/log-detail.html?log=5tytkRRnuHQ7AmE&public=true

is failing the state verification.

The URL the test suite generates is: https://duendesoftware-test.azurewebsites.net/connect/endsession?id_token_hint=eyJhbGciOiJSUzI1NiIsImtpZCI6IjFBMTYzRTQzQzI0QUFEQUIyQzM2Q0JGNzMyNzM3ODQxIiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwczovL2R1ZW5kZXNvZnR3YXJlLXRlc3QuYXp1cmV3ZWJzaXRlcy5uZXQiLCJuYmYiOjE2MTM5OTgzNzUsImlhdCI6MTYxMzk5ODM3NSwiZXhwIjoxNjEzOTk4Njc1LCJhdWQiOiJiYXNpYyIsImFtciI6WyJwd2QiXSwibm9uY2UiOiI3MjFPNk1QWndBIiwiYXRfaGFzaCI6ImFyOF9SdXJ5SVdQYXItLXdpRmtHS1EiLCJzaWQiOiJCNTM0RjEzNjdCQzBBMTc0MTY1NDA1QjkwQTVEOTQwMCIsInN1YiI6Ijg4NDIxMTEzIiwiYXV0aF90aW1lIjoxNjEzOTk4MzczLCJpZHAiOiJsb2NhbCJ9.DJyp3ugQdgpyyjK1K2JDxT9ppUZzYhNPlyuLjrOmQuGYuK_cjWrKGHDsvu-fowoqdCZ_qzY5-8IO6QCoCNNU5V6botL5iZphNTOpaA8_WQgpVSZdwSbl1dYj-AjCpjSVl0Hc3BZK8HA2JbqaigRgh7K4RvfvPZ3rQ-PKQG_lG985hLVnGPz2u0cYHKng-5sIEWx9aWJo5bdMPV8zPM-RIEqE8VQd1TZlAsQocFmpiJn0-FJ-S5AhtyuJ78dkpU9Z5qboSzHleMPyuzhR05lbwhbkNvthMRZun5TmwA2d2u3hqhfd0LzI9MXX3P3Soza-ye-FOlUXduFPTKZd3olrFg&post_logout_redirect_uri=https://www.certification.openid.net/test/a/duende_oidc/post_logout_redirect&state=ZdMfMnbohbhCASjaeKFpgUNFfVmVkRhRyQOVLlxOyCfFVAPgsJ0227905547.%23/%22~(%25%7B%26;!%5D,::%26%25%3E;%5D%3E:'%7B~)%7C~

The return URL that we submit back is:

https://www.certification.openid.net/test/a/duende_oidc/post_logout_redirect?state=ZdMfMnbohbhCASjaeKFpgUNFfVmVkRhRyQOVLlxOyCfFVAPgsJ0227905547.%23%2F%22~(%25%7B%26;!%5D,%3A%3A%26%25%3E;%5D%3E%3A%27%7B~)%7C~

spring seems to be truncating the incoming url query at the unencoded ';' for reasons that aren't entirely clear.

According to https://tools.ietf.org/html/rfc3986#section-3.4 the ABNF for the query is:

query = *( pchar / "/" / "?" )

and pchar is this:

pchar = unreserved / pct-encoded / sub-delims / ":" / "@"

and sub-delims is this:

sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="

so a literal ';' appears to be valid. Although other software that has passed the logout tests have encoded the ';', e.g.:

https://www.certification.openid.net/log-detail.html?log=tjEVVhBqll6xFyO&public=true

At least for now it seems sane to avoid ';' in states we generate. Possibly really the specs should discourage the use of ';' and a few other problematic characters.

Originally discussed at https://openid.atlassian.net/jira/servicedesk/projects/OCS/queues/custom/10/OCS-13 and https://openid.atlassian.net/jira/servicedesk/projects/OCS/queues/custom/10/OCS-14