OIDC frontend ignores `prompt=none`

[delhage]

OIDC frontend ignores prompt=none

The OIDC OP frontend does not implement the prompt request parameter. An
authorization request with prompt=none is treated identically to one without
it: the user is redirected to the SAML IdP discovery service instead of being
returned to the client with an error.

OpenID Connect Core 1.0 §3.1.2.1 requires that with prompt=none the
Authorization Server MUST NOT display any authentication or consent UI, and
must return an error (typically login_required) to the redirect URI if the
End-User is not already authenticated.

Reproduce

Two requests differing only in prompt=none, with no existing session:

for extra in "" "--data-urlencode prompt=none"; do
  curl -s -o /dev/null -D- -G \
    https://tunnelbana-demo.labb.sunet.se/OIDC/authorization \
    --data-urlencode response_type=code \
    --data-urlencode client_id=<registered-client> \
    --data-urlencode redirect_uri=<registered-redirect-uri> \
    --data-urlencode 'scope=openid email profile' \
    --data-urlencode state=x --data-urlencode nonce=x \
    $extra | grep -i '^location:'
done

Both return the same 302:

location: https://service.seamlessaccess.org/ds/?entityID=https%3A%2F%2Ftunnelbana-demo.labb.sunet.se%2F&return=https%3A%2F%2Ftunnelbana-demo.labb.sunet.se%2FSaml2SP%2Fdisco

Expected for the prompt=none case: 302 to the registered redirect_uri
with error=login_required and the original state.

Impact

This breaks silent-login / session-check flows for any relying party, since
there is no way to ask "is this user already signed in?" without navigating them
into an interactive login.

Concretely, it makes La Suite Meet's FRONTEND_IS_SILENT_LOGIN_ENABLED unusable:
Meet retries silent login after any 401, including the one an anonymous
visitor to a public room legitimately receives, so a shareable room link drags
that visitor into full SSO. We have had to disable the feature.

Observed on tunnelbana-demo.labb.sunet.se, 2026-08-23.

We only tested prompt=none; the other prompt values and max_age may be
affected in the same way.