Fix behavior for PIV/CAC declined setup from sign-in

[aduth]

🛠 Summary of changes

Ensures that when the user opts to decline the option to set up a PIV/CAC authenticator after attempting to sign in with it without having first linked an account, the user arrives at the correct place. Previously, the user would arrive at their account dashboard, even if they had started from a partner application.

Before these changes, the existing controller action for Users::PivCacSetupFromSignInController#decline is unused.

📜 Testing Plan

Easiest to test with PIV/CAC simulator in local development. In config/application.yml:

identity_pki_disabled: true

1. Have OIDC sample app running in a separate terminal process
2. Go to http://localhost:9292
3. Click "Sign in"
4. Click "Sign in with your government employee ID"
5. Click "Insert your PIV/CAC"
6. Authenticate with a PIV credential not already associated to an account
7. On the screen "Your PIV/CAC is not connected to an account", click "Go back to sign in"
8. Sign in to an existing account
9. On the screen "Add your PIV or CAC", click "No thanks" to decline setting up PIV

Before: You'd be redirected to your account page, with a link to "Continue to [SP]"

After: Depending if you've already granted consent for the SP, you're either redirected back to the SP or prompted to agree and continue

👀 Screenshots

Setup screen:

Before	After