Keep the URL fragment after the wayfReset query parameter

# If applied, this commit will
Fix redirects whose target URL contains a fragment so wayfReset
actually reaches the destination app as a real query parameter.

# Why is this change needed?
Prior to this change, appendQueryParameter() always concatenated the
wayfReset parameter onto the end of the URL string. For a target URL
with a fragment, that put the query parameter after the '#', where
it is treated as part of the fragment by browsers and never seen as
a real query parameter.

# How does it address the issue?
This change splits off any fragment before appending the query
parameter, then re-appends the fragment at the very end, producing
the conventional ...?wayfReset=...#fragment shape.

# Provide links to any relevant tickets, articles or other resources
Found during review of PR #2097.

Author: kayjoosten

src/OpenConext/EngineBlockBundle/Controller/ResetRememberedWayfController.php

@@ -90,8 +90,16 @@ private function resolveRedirectTarget(?string $redirect): string
 
     private function appendQueryParameter(string $url, string $key, string $value): string
     {
+        $fragment = '';
+        $hashPosition = strpos($url, '#');
+
+        if ($hashPosition !== false) {
+            $fragment = substr($url, $hashPosition);
+            $url = substr($url, 0, $hashPosition);
+        }
+
         $separator = str_contains($url, '?') ? '&' : '?';
 
-        return $url . $separator . $key . '=' . rawurlencode($value);
+        return $url . $separator . $key . '=' . rawurlencode($value) . $fragment;
     }
 }

tests/unit/OpenConext/EngineBlockBundle/Controller/ResetRememberedWayfControllerTest.php

@@ -178,6 +178,30 @@ public function a_redirect_parameter_that_already_has_a_query_string_is_appended
         );
     }
 
+    #[Test]
+    public function a_redirect_parameter_with_a_fragment_keeps_the_fragment_after_the_query_string(): void
+    {
+        $cookieService = Phake::mock(CookieService::class);
+        $rememberedIdpCookie = $this->buildRememberedIdpCookie($cookieService);
+
+        $logger = Mockery::mock(LoggerInterface::class);
+        $logger->shouldNotReceive('info');
+
+        $controller = new ResetRememberedWayfController(
+            $rememberedIdpCookie,
+            $logger,
+            self::REDIRECT_URL,
+            self::ALLOWED_REDIRECT_HOSTS,
+        );
+
+        $response = $controller($this->buildRequest(null, 'https://profile.example.org/my-profile#login-methods'));
+
+        $this->assertSame(
+            'https://profile.example.org/my-profile?wayfReset=none#login-methods',
+            $response->getTargetUrl()
+        );
+    }
+
     #[Test]
     public function a_redirect_parameter_pointing_at_a_host_that_is_not_allowed_falls_back_to_the_configured_redirect(): void
     {