Enable IdP-initiated SAML flows and simplify authentication

Simplifies SAML authentication by using RelayState to contain the SAML
config ID for both SP-initiated and IdP-initiated flows, removing the
need for the relay_states table and associated token management.

Key changes:
- Enable IdP-initiated flows with AllowIDPInitiated flag
- Use RelayState for SAML config ID instead of secure tokens
- Remove auth_saml_relay_states table and related code
- Maintain InResponseTo validation for SP-initiated flows
- Fix MetadataURL to use entity ID instead of ACS URL

This enables IdP-initiated SAML logins (e.g., from Google Workspace,
Azure Entra ID, Okta) while maintaining security through request ID
validation and assertion replay prevention.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/auth/saml_validator.go

@@ -101,7 +101,3 @@ func CleanupExpiredAssertions(ctx context.Context, conn pg.Conn) (int64, error)
 func CleanupExpiredRequests(ctx context.Context, conn pg.Conn) (int64, error) {
 	return coredata.DeleteExpiredSAMLRequests(ctx, conn, time.Now())
 }
-
-func CleanupExpiredRelayStates(ctx context.Context, conn pg.Conn) (int64, error) {
-	return coredata.DeleteExpiredSAMLRelayStates(ctx, conn, time.Now())
-}