SAML SLO support

[andreas-kupries]

Issue:

Fix #38494

This work is co-dependent on the UI work tracked at rancher/dashboard#10941

Problem

SURE 3572

Solution

PR holds work checkpoints at the moment. Not in a merge-able state.

1. Extended AuthConfig, SamlConfig with the proposed flags about SLO (supported, enabled, forced).
   1. Based on the CRD setup the supported flag might be nonsense.
   2. As in, cannot be set into the initial AuthConfig CR instances. UI may have to simply know that only the SAML providers support SLO, and none of the others.
2. New structures SamlConfigLogoutInput, and ...Output. Same fields as the known SamlConfigTest... structures. Hold the request/response data from/to the UI for the logoutAll action (see below).
3. The tokens API should export a new action logoutAll.
4. Basic implemention of the logout flow. Compiles, untested.
5. Linkage between token manager and saml to invoke the flow from the frontend

KNOWN ISSUES: Does not guard against call of regular logout when SLO is forced.
Does guard against forced but not enabled, and call to logout-all when not enabled.

Testing

Engineering Testing

Manual Testing

Automated Testing

• Test types added/modified:
  • Unit
  • Integration (Go Framework)
  • Integration (v2prov Framework)
  • Validation (Go Framework)
  • Other - Explain: EXPLAIN
  • None
  • REMOVE NOT APPLICABLE BULLET POINTS ABOVE
• If "None" - Reason: EXPLAIN THE REASON
• If "None" - GH Issue/PR: LINK TO GH ISSUE/PR TO ADD TESTS

Summary: TODO

QA Testing Considerations

Regressions Considerations

TODO

Existing / newly added automated tests that provide evidence there are no regressions:

• TODO