feat: harden the myep OAuth2 login

tests/Controller/Security/LogoutAuditTest.php

@@ -51,7 +51,11 @@ class LogoutAuditTest extends WebTestCase
         $this->em->flush();
 
         $this->client->loginUser($user);
-        $this->client->request('GET', '/logout');
+
+        // Submitted from the page rather than requested directly: the firewall's logout is
+        // CSRF-protected, so the token in the header form is part of what is being pinned down.
+        $crawler = $this->client->request('GET', '/');
+        $this->client->submit($crawler->filter('form[action$="/logout"]')->form());
 
         self::assertResponseRedirects();