Support Slack workspace SAML single sign-on

• Support Slack workspace SAML single sign-on: seedable SAML configuration, an SP-initiated AuthnRequest with the HTTP-POST binding, and POST /sso/saml validating signed responses, the issuer, audience, recipient, destination, validity and persistent NameID, with JIT provisioning from User.Email.
• Open a web session on success and, when SSO is required, send the OAuth authorization page through SAML with the documented owner and guest exceptions, with regression coverage, the coverage matrix entries, and docs.

References:

• ACS URL, entity ID, HTTP-POST binding, NameID, User.Email, signed response, IdP- and SP-initiated flows, JIT: https://slack.com/help/articles/205168057-Custom-SAML-single-sign-on
• SSO requirement options and the owner bypass: https://slack.com/help/articles/203772216-SAML-single-sign-on
• Refusal messages: https://slack.com/help/articles/360037402653

Fixes #384