Backport of Regression bug fix OIDC namespace into release/1.12.x

[hc-github-team-secure-vault-core]

Backport

This PR is auto-generated from #19460 to be assessed for backporting due to the inclusion of the label backport/1.12.x.

WARNING automatic cherry-pick of commits failed. Commits will require human attention.

merge conflict error: POST https://api.github.com/repos/hashicorp/vault/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.

---

This PR #15378 implemented using the URL api because Ember was stripping out the ns param via the paramsFor method. While implementing a fix for cluster namespace flags (PR #16886), we discovered paramsFor was no longer stripping out the namespace.

However, this introduced a regression because ADFS decodes the namespace portion of the state query param in the callback uri, but doesn't separate it as a separate query param using &. Thus paramsFor was unable to recognize ns as a separate parameter and authentication failed. (See these lines in the test file for examples and a more in depth explanation.)

Thanks to @austingebauer for checking out this branch and testing it with his local AD FS setup to confirm this does in fact fix the issue!

---

Overview of commits

• dcb44bb

[hashicorp-cla]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

temp seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA. If you already have a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}