Support organization SAML single sign-on in the GitHub emulator

• Support organization SAML single sign-on in the GitHub emulator: seedable SAML configuration, SP metadata, GET /orgs/:org/sso and POST /orgs/:org/saml/consume with the documented checks on the response, bound to the browser session that sent the request so the identity provider's cross-site POST needs no cookie.
• Link the external identity on first sign-in, relink it after the documented warning, keep a 24-hour SAML session or until SessionNotOnOrAfter, and follow RelayState only to paths on the emulator's own origin, with regression coverage and docs.

References:

• SP metadata, entity ID, ACS URL, binding, and the NameID, signature, Destination, Recipient, Audience and session requirements: https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/iam-configuration-reference/saml-configuration-reference
• Linked external identities and the relink warning: https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/about-authentication-with-saml-single-sign-on

Fixes #382