Add a `pinniped logout` command

[aslafy-z]

Is your feature request related to a problem? Please describe.

Deleting the cache folder to logout may not be straightforward for all users and the path changes between OSes.

Describe the solution you'd like

A pinniped logout cli command.

Describe alternatives you've considered

Delete the cache folder.

Are you considering submitting a PR for this feature?
Yes, why not!

• How will this project improvement be tested? With unit tests.
• How does this change the current architecture? N/A
• How will this change be backwards compatible? N/A
• How will this feature be documented? Update this section and some other. https://github.com/vmware-tanzu/pinniped/blob/83ab099b8437ff01a0686db610de9e134d13687c/site/content/docs/howto/debugging.md?plain=1#L162-L172

[aslafy-z]

A nice thing would be to also redirect to the logout url of the provider. This would add complexity as it would need to update the supervisor code to include a redirect or backchannel logout logic.

[joshuatcasey]

Could you give more details on the use-case for this feature? Often Pinniped allows login to multiple K8s "workload" clusters from one "management" cluster. Would a logout mean that a user could no longer use one particular cluster, or all clusters?

Is there a security compliance concern driving this feature?

[joshuatcasey]

Hi @aslafy-z just following up on the above questions.

[aslafy-z]

The goal is to completely log out of all sessions (all clusters), ensuring that the next login requires entering new credentials. This is particularly useful for testing multi-tenant scenarios, where switching between different identities needs to be streamlined without manually deleting cached credentials.