docs: document the logout param allowlist and the PKCE settings

[FrankApiyo]

Documents five settings the module reads but the README never mentioned. Docs-only — no code changes.

Split out of #124, where these sections were originally added. Neither belongs there: that PR touches no PKCE code at all, and LOGOUT_QUERY_PARAM_ALLOWLIST predates it.

LOGOUT_QUERY_PARAM_ALLOWLIST

Its login counterpart is documented; this one wasn't. Includes the collision rule the code implements (viewsets.py): values ona-oidc stashes server-side, such as id_token_hint, win over a caller-supplied query param rather than being overridden.

PKCE

USE_PKCE, PKCE_CODE_CHALLENGE_METHOD, PKCE_CODE_CHALLENGE_TIMEOUT, PKCE_CODE_VERIFIER_LENGTH — with the defaults read from oidc/settings.py.

One trap worth the table entry:

def _generate_pkce_code_challenge(self, code_verifier):
    digest = hashlib.sha256(code_verifier.encode("ascii")).digest()   # always S256

PKCE_CODE_CHALLENGE_METHOD only labels the outgoing parameter — the challenge is always SHA-256. Setting it to "plain" would advertise plain while still sending a hashed challenge, and the IdP would reject the exchange. Documented as "leave it", not as a free choice.

PKCE_CODE_CHALLENGE_TIMEOUT is the TTL on the cached state → code_verifier entry (cache.set(state_cache_key(state), code_verifier, self.pkce_code_challenge_timeout)), so it also caps how long a login may sit before its callback completes.

Test plan

• Rendered README reads correctly on GitHub (tables, heading order)
• Defaults match oidc/settings.py

No code touched, so CI is a formality here.