docs(sso): document the SAML role-attribute risk and the SameSite requirement

[marevol]

Three additions to 15.8/config/sso-saml.rst, applied to all seven languages (ja, en, de, es, fr, ko, zh-cn).

1. The role attribute can hand out administrator rights

saml.attribute.role.name is documented as a plain attribute mapping, but SamlCredential#getDefaultRolesAsArray copies the IdP attribute values into the Fess roles verbatim, and authentication.admin.roles defaults to admin in fess_config.properties. Any user whose role attribute contains admin therefore becomes a Fess administrator.

This is how Fess SSO works generally — the Entra ID authenticator maps Graph directoryRole objects into roles the same way — so this is a warning on the page rather than a code change. But the page gave no hint of it, and the example it shows is saml.attribute.role.name=roles, which is exactly the configuration where it matters.

2. SameSite breaks the ACS callback

tomcat_config.properties ships tomcat.sameSiteCookies = lax, which FessBoot applies to every context's cookie processor, so JSESSIONID carries SameSite=Lax.

The SAML assertion reaches /sso/ as a cross-site POST from the IdP's auto-submitting form, and a cookie with an explicit SameSite=Lax is not sent with it. getLoginCredential() then sees no session, treats the request as a fresh visit and issues another AuthnRequest — the login loops between Fess and the IdP.

Added to the existing "cannot return to Fess after authentication" troubleshooting entry, with tomcat.sameSiteCookies = none as the fix and the note that SameSite=None requires HTTPS. The comment in tomcat_config.properties only mentioned OAuth/OIDC, whose callback is a top-level GET and is unaffected; codelibs/fess#3224 corrects that comment.

3. The insecure-settings warning

codelibs/fess#3224 makes Fess log Insecure SAML settings: ... when java-saml reports weak configuration. Mentioned in the security section so operators can connect the log line to the settings on this page.

Item 3 describes behaviour from codelibs/fess#3224. Items 1 and 2 describe the current release and are accurate today.

Verification

Each file was parsed with docutils (Sphinx-only directives and roles filtered out) — no structural, indentation or escape errors in any of the seven. The zh-cn text follows the existing \ ``literal``\ spacing convention used elsewhere on the page.