Output guardrail enhancements

[manamittal]

Description

Two additions to guardrail block handling: graceful logout, and letting an output guardrail answer in the model's place.
Needs to be merged in with semoss-ui change https://github.com/SEMOSS/semoss-ui/tree/logout-guardrails

Changes Made

logoutOnBlock — new guardrail config flag on both the input and output reactors, carried through as PipelineReactorUtils.LOGOUT_USER. On a block, PipelineInvocationHandler.logoutIfRequested calls the new User.markPendingRevocation("GUARDRAIL"), which flags the session without clearing loggedInProfiles/accessTokens — so the current request still finishes and carries the block back. The error is tagged with a new PixelOperationType.USER_LOGGED_OUT_ERROR (registered in PixelRunner's errorOpTypes) for the client to show a dialog and then call /api/auth/logout/all itself. Any later engine call from a flagged session is refused up front at the top of invoke. Anonymous users and unresolvable sessions no-op, and the helper returns whether a session was actually revoked so the audit action is accurate.

respondWithGuardrailMessage — on the output side, a failing guardrail can now return its own returnPrompt as an AskStringModelEngineResponse instead of throwing, mirroring the input side's existing canned-response path. It suppresses LOGOUT_USER, and on non-AskModelEngineResponse return types it falls back to the normal block/throw.

Logging — resolveUser picks the user off a Room arg, then an Insight arg, then ThreadStore. The GUARDRAIL_ACTION column gains BLOCK_LOGOUT, and the output path now records RESPOND (it previously only ever logged MASK/BLOCK).

How to Test

1. Steps to reproduce/test the behavior
2. Expected outcomes

Notes

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.