Add SAML 2.0 apps to the Okta emulator

• Add SAML 2.0 apps to the Okta emulator: an external key, the SSO URL with the HTTP-Redirect and HTTP-POST bindings and IdP-initiated sign-in, metadata at the app URL and on the Apps API, and assertions signed per settings.signOn.
• Give no assertion to a user who is not assigned to the app or not ACTIVE, or through a deactivated app (answered as an unknown app, 404, since Okta does not document the response), and refuse an app that signs neither the response nor the assertion with E0000001, with regression coverage and docs; the SAML building blocks come from #9 by Tbsheff.

References:

• SAML 2.0 app settings, SSO URL bindings and metadata: https://raw.githubusercontent.com/okta/okta-management-openapi-spec/master/dist/current/management-minimal.yaml
• SSO URL, issuer and signing options: https://help.okta.com/en-us/content/topics/apps/aiw-saml-reference.htm
• "403 App Not Assigned": https://support.okta.com/help/s/article/App-Sign-on-Error-403-User-attempted-unauthorized-access-to-app
• E0000001, API validation exception: https://developer.okta.com/docs/reference/error-codes/
• A deactivated app integration refuses SSO ("any users currently signed in to Okta receive an error message"): https://help.okta.com/en-us/Content/Topics/Apps/apps-deactivate.htm

Fixes #380