Keycloak auth flow improvements

[Lordfirespeed]

• Allow destination to be specified via query parameters to /auth/keycloak/login
  • this should be validated against a list of permitted values, and a missing value should not be permitted
  • allowed values e.g. [`{frontendOrigin}/dashboard`, `{frontendOrigin}/sponsor`, `{frontendOrigin}/volunteer`, `{frontendOrigin}/organiser`]
  • the value should be saved in the user session once validated, and the request processed as usual otherwise
• Read destination from the user session, redirect to it in /auth/keycloak/callback
• Handle error in /auth/keycloak/callback (Keycloak OAuth flow callback endpoint does not handle error query parameter #167)