SAML auth provider, driven by AMP

[gbuisson]

add SAML auth provider support, the goal is to get the one for AMP working: https://console.amp.cisco.com/saml/metadata

• also add support for JWT (encrypted and signed keys)
• a JWT token shall be set on login
• the token must have a timeout, in minutes
• add a refresh endpoint, where it takes the current key and sets a new one

[craigbro]

Repeated issue, represented by iroh and iroh-auth issues.