Fix SSO redirect_uri_mismatch on target subdomains

[SteezyCougar]

After upstream #1912 refactored construct_external_url to always read the request Host header, SSO redirects from target subdomains (e.g. grafana.warp.example.com) send the wrong redirect_uri to the OAuth provider. Force the SSO return URL to use external_host from config, which is what gets registered in the OAuth provider.

Ref: warp-tech/warpgate#1947

[Eugeny]

Could you please describe your setup in terms of domains? Do your users always get redirected back to the primary domain when they log in?

I'll try to reconcile this with what that change is actually trying to fix: allowing complete SSO flow to happen on the subdomain (with every subdomain having a matching redirect URL registered with SSO)

[Eugeny]

Assuming your setup is as you described, I think we'll actually need a config flag to switch the behaviour

[SteezyCougar]

Basically

Warpgate runs on warpgate.my-domain.com

We use subdomain binding so users can:

1. connect to multiple targets at a time (Users constantly have to be connected to 3 or 4 things at once)
2. Share links that will link to a target and work even if you were pointed at a different target

So that means we have like

Cool-application.warpgate.my-domain.com
Another-one.warpgate.my-domain.com
third-one.warpgate.my-domain.com

That's why we we are having just warpgate.my-domain.com handle the authentication for these sub-domains, otherwise every time we modify or add one we have to go and update it in google settings.

But we have a LOT of these targets, enough that setting every single one as a redirect URL and authorized domain isn't going to be practical

[Eugeny]

Adding the option in #1971 - would appreciate if you could give it a quick check - return_url_domain: external_host should basically revert it to the previous behaviour