Function resolveCallbackRedirect

Resolves the post-login redirect URL from the session state.

• If session has redirectTo and authCallbackUrl is configured, returns authCallbackUrl?redirect_to=<encoded redirectTo>.
• If session has redirectTo but authCallbackUrl is absent, returns a misconfiguration error.
• If no redirectTo, returns clientUrl (or a misconfiguration error when clientUrl is also absent).