connector/saml: implement SP-Initiated Single Logout via LogoutCallbackConnector

[Jabejixo]

Overview

Add SAML Single Logout (SLO) support to the SAML connector by implementing
the LogoutCallbackConnector interface from #4674.

What this PR does / why we need it

The SAML connector does not support Single Logout - when a user logs out
through Dex, the upstream IdP session stays active.

This PR adds two methods to the SAML connector:

• LogoutURL - builds a <LogoutRequest> with HTTP-Redirect binding
  (DEFLATE + base64) using NameID and SessionIndex captured during login.
• HandleLogoutCallback - validates the IdP's <LogoutResponse> for both
  HTTP-Redirect (GET) and HTTP-POST bindings with binding-aware signature
  validation.

New config fields: sloURL (IdP's SLO endpoint) and
insecureSkipSLOSignatureValidation. Existing ca/caData certificates
are reused - no additional configuration required.

Special notes for your reviewer

• No changes to server-side code - uses the existing LogoutCallbackConnector
  interface called by logout.go.
• NameID, NameIDFormat, and SessionIndex are persisted in ConnectorData
  during HandlePOST alongside the existing refresh token fields.
• Fixed a latent bug: nameID.Format XML tag was missing attr — it is an
  attribute, not a child element.
• HTTP-Redirect signature validation (Signature/SigAlg query params) is
  implemented separately from embedded XML signatures.