Enable IdP-initiated SAML flows and simplify authentication

Simplifies SAML authentication by using RelayState to contain the SAML
config ID for both SP-initiated and IdP-initiated flows, removing the
need for the relay_states table and associated token management.

Key changes:
- Enable IdP-initiated flows with AllowIDPInitiated flag
- Use RelayState for SAML config ID instead of secure tokens
- Remove auth_saml_relay_states table and related code
- Maintain InResponseTo validation for SP-initiated flows
- Fix MetadataURL to use entity ID instead of ACS URL

This enables IdP-initiated SAML logins (e.g., from Google Workspace,
Azure Entra ID, Okta) while maintaining security through request ID
validation and assertion replay prevention.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/auth/saml_cleanup.go

@@ -74,7 +74,7 @@ func (c *Cleaner) Run(ctx context.Context) error {
 }
 
 func (c *Cleaner) cleanup(ctx context.Context) error {
-	var assertionsDeleted, requestsDeleted, relayStatesDeleted int64
+	var assertionsDeleted, requestsDeleted int64
 
 	err := c.pg.WithConn(
 		ctx,
@@ -91,12 +91,6 @@ func (c *Cleaner) cleanup(ctx context.Context) error {
 			}
 			requestsDeleted = count
 
-			count, err = CleanupExpiredRelayStates(ctx, conn)
-			if err != nil {
-				return err
-			}
-			relayStatesDeleted = count
-
 			return nil
 		},
 	)
@@ -105,11 +99,10 @@ func (c *Cleaner) cleanup(ctx context.Context) error {
 		return err
 	}
 
-	if assertionsDeleted > 0 || requestsDeleted > 0 || relayStatesDeleted > 0 {
+	if assertionsDeleted > 0 || requestsDeleted > 0 {
 		c.logger.InfoCtx(ctx, "cleaned up expired SAML data",
 			log.Int64("assertions", assertionsDeleted),
-			log.Int64("requests", requestsDeleted),
-			log.Int64("relay_states", relayStatesDeleted))
+			log.Int64("requests", requestsDeleted))
 	}
 
 	return nil