auth: support SAML 2.0 login sources - #8394

Describe the pull request

This adds native, SP-initiated SAML 2.0 authentication as a Gogs login source.

Highlights:

• Adds database-backed and auth.d SAML source configuration, generated SP metadata, and admin UI fields.
• Supports HTTP-Redirect and HTTP-POST authentication request bindings with HTTP-POST responses.
• Signs authentication requests with SHA-256 and validates response signatures, audience, recipient, timestamps, and request IDs through crewjam/saml.
• Uses signed, short-lived, source-scoped relay cookies and removes them after successful validation to prevent request forgery and replay.
• Provisions users by a stable source-scoped external identifier. Matching usernames or email addresses are never silently linked to an existing local account.
• Preserves Gogs local MFA for SAML-provisioned users and filters post-login redirects through the existing same-site policy.
• Adds sign-in UI, localization keys, an example configuration, administrator documentation, unit tests, and a changelog entry.

The initial scope intentionally excludes IdP-initiated sign-in and single logout. These limitations are documented.

Link to the issue: Fixes #1221

Bounty: https://oss.issuehunt.io/r/gogs/gogs/issues/1221

Checklist

• I agree to follow the Code of Conduct by submitting this pull request.
• I have read and acknowledge the Contributing guide.
• I have added test cases to cover the new code or have provided the test plan.
• I have added an entry to CHANGELOG.

Test plan

Automated checks run locally:

go test -cover -race ./...
go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest run --timeout=30m
pnpm --dir web lint
pnpm --dir web build
go build -trimpath -tags prod -o /tmp/gogs-saml-build ./cmd/gogs

The tests cover SAML attribute mapping, SP key and metadata configuration, signed relay-cookie creation and deletion, file-backed source loading, source partitioning, safe redirect handling, source-scoped account provisioning, username and email collision handling, concurrent provisioning recovery, and inactive-source rejection.

Manual interoperability steps:

1. Generate an RSA or ECDSA certificate and key, then create an active SAML 2.0 source in the admin panel.
2. Import the generated Gogs metadata URL into a SAML 2.0 identity provider.
3. Configure the IdP to release the selected login, username, email, and optional full-name attributes.
4. Sign in from the Gogs button and verify first-login provisioning, repeat login, redirect_to handling, and local MFA handoff.
5. Verify that an assertion using an already-owned username or email stops with the provisioning error instead of linking accounts.