OidcRequestAuthenticator.rewrittenRedirectUri retains url query when there's no rewrite rule, but removes it when there's a rewrite rule

1. Set up an OpenID-enabled authentication server with a client. 2. Set up a servlet protected by Elytron with OIDC auth-method. Something like: <security-constraint> <web-resource-collection> <web-resource-name>Debug Endpoint</web-resource-name> <url-pattern>/debug</url-pattern> </web-resource-collection> <auth-constraint> <role-name>debug</role-name> </auth-constraint> </security-constraint> <security-role> <role-name>debug</role-name> </security-role> <login-config> <auth-method>OIDC</auth-method> </login-config> <servlet> <servlet-name>DebugServlet</servlet-name> <servlet-class>com.example.service.DebugServlet</servlet-class> </servlet> <servlet-mapping> <servlet-name>DebugServlet</servlet-name> <url-pattern>/debug</url-pattern> </servlet-mapping> 3. Configure OIDC with `WEB-INF/oidc.json`, such as:   { "provider-url": "https://my.keycloak.server.url:443/sso/oauth2", "ssl-required": "none", "client-id": "client-449550", "public-client": true, "credentials": { "secret": "my-client-secret" }, "enable-basic-auth": true, "redirect-rewrite-rules": { "will-not-match": "my-replacement-str" } } 4. Visit the `debug` endpoint specified in step 2. It should redirect the user to the authentication server, where they log in, which would then redirect them back to `debug` along with a code, iss [uer] , state, and client_id in the url's query. 5. Elytron will attempt to verify the code with the authentication server and get a token. If `redirect-rewrite-rules` in oidc.json is specified and not empty, the redirect_url specified as the `debug` endpoint with no query string. If `redirect-rewrite-rules` is removed from oidc.json or left empty, the redirect_url given to the auth server will include the iss [uer] and client_id query parameters still in place.