Consider as a side issue adjacent to OD-2241.

We are investigating leveraging OneDev for our CI/CD use-cases, and after a web security assessment, the assessors determined that the current approach to how idle session timeouts are handled does not meet their OWASP standard for idle session timeouts (currently configured as no timeout as long as browser/machine is open/active, considered problematic if user goes on leave and intrusion happens while PC/browser is active) [OWASP Session Management - Idle Timeouts]. Assessor recommends idle timeout client-side to be one-hour of inactivity regardless of browser/PC active, but rather if there is activity going on within the page itself.

This ticket proposes a configurable option that allows admins to set a global idle session timeout for users (can default to the current settings).