Enable IdP-initiated SAML flows and simplify authentication

Simplifies SAML authentication by using RelayState to contain the SAML
config ID for both SP-initiated and IdP-initiated flows, removing the
need for the relay_states table and associated token management.

Key changes:
- Enable IdP-initiated flows with AllowIDPInitiated flag
- Use RelayState for SAML config ID instead of secure tokens
- Remove auth_saml_relay_states table and related code
- Maintain InResponseTo validation for SP-initiated flows
- Fix MetadataURL to use entity ID instead of ACS URL

This enables IdP-initiated SAML logins (e.g., from Google Workspace,
Azure Entra ID, Okta) while maintaining security through request ID
validation and assertion replay prevention.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/auth/saml_acs_handler.go

@@ -60,15 +60,6 @@ func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, auth
 			return
 		}
 
-		relayState := r.FormValue("RelayState")
-		samlConfigID := r.URL.Query().Get("c")
-
-		if relayState != "" {
-			logger.InfoCtx(ctx, "processing SP-initiated SAML login")
-		} else {
-			logger.InfoCtx(ctx, "processing IDP-initiated SAML login", log.String("config_id", samlConfigID))
-		}
-
 		userInfo, err := samlSvc.HandleSAMLAssertion(ctx, r)
 		if err != nil {
 			logger.ErrorCtx(ctx, "SAML authentication failed", log.Error(err))