fix(auth): correctly handle non-fragment callbacks

[SF2311]

According to https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2 OIDC callback URLs must not contain a fragment component. Thus, some OIDC providers (at least mine) don't support this, but setting the callback to a path results in 404 from the web server because no actual page exists there.

This PR adds two pages /auth and /silent-auth to allow error-free handling of the callback. It should thereby resolve #398.

[CLAassistant]

All committers have signed the CLA.