csm: add Zalo logout and revokeSessions

Support POST /mscsm/user/logout and revoke-sessions with App accessToken and sessionKey for Host BFF.

Co-authored-by: Cursor cursoragent@cursor.com