Support Google Workspace SAML single sign-on

• Support Google Workspace SAML single sign-on: seedable SSO profiles, an unsigned AuthnRequest with the HTTP-POST binding for covered users, and POST /samlrp/:id/acs validating the signed response, NameID, Recipient, Audience, Destination, validity and InResponseTo.
• Open a 14-day Google session on success, after which OAuth consent authorizes the signed-in user; users without a profile and super administrators are unchanged, with regression coverage and docs.

References:

• Entity ID and ACS forms, unsigned requests, HTTP-POST binding, signed assertions with RSA-SHA256, no IdP-initiated sign-on: https://docs.cloud.google.com/architecture/identity/single-sign-on
• NameID, Recipient, Audience and Destination requirements: https://support.google.com/a/answer/6330801
• Profiles assigned to organizational units or groups; super administrators: https://knowledge.workspace.google.com/admin/apps/setting-up-sso, https://knowledge.workspace.google.com/admin/apps/super-administrator-sso
• 14-day default web session: https://support.google.com/a/answer/7576830

Fixes #386