Slack: workspace SAML single sign-on

Problem

A Slack workspace can require SAML single sign-on: the IdP posts to the "SSO post-back up URL https://yourdomain.slack.com/sso/saml", the entity ID is https://slack.com, "Slack supports HTTP POST binding, not HTTP REDIRECT", the NameID is persistent, User.Email is required, and "Slack requires that the SAML response is signed"; both IdP- and SP-initiated sign-in and JIT provisioning are supported (https://slack.com/help/articles/205168057-Custom-SAML-single-sign-on). SSO can be "required for all members, required for all members excluding guests, or optional", and "Workspace Owners and Org Owners can bypass SSO authentication" (https://slack.com/help/articles/203772216-SAML-single-sign-on). The Slack emulator has no SAML, so an app's install flow or a test that relies on workspace SSO cannot run against it.

Proposal

• Workspace SAML configuration in seed config (SAML 2.0 endpoint, IdP issuer, x.509 certificate, signing options, SSO requirement), an SP-initiated sign-in that posts an AuthnRequest to the IdP, and POST /sso/saml validating the response as documented, with Slack's own troubleshooting messages for refusals (https://slack.com/help/articles/360037402653).
• A web session opened by a successful sign-in; with SSO required, the OAuth authorization page goes through SAML and authorizes the signed-in member, with the documented owner and guest exceptions. Workspaces without SAML are unchanged.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/slack-workspace-saml. Happy to open a pull request for it.