fix(sso): bind SAML responses to the AuthnRequest and reject replays

[marevol]

Summary

The SAML ACS callback (SamlAuthenticator.getLoginCredential()) accepted any valid assertion and reported nothing when one was rejected. This PR closes both gaps.

1. SAML_STATE never bound the response to a request

SAML_STATE held a freshly generated UUID. auth.login(null, ...) discards auth.getLastRequestId() and java-saml puts the current URL in RelayState when the first argument is null, so the UUID was never transmitted to the IdP and never compared with anything — it only signalled "a SAML login is in progress".

The callback then called the no-arg auth.processResponse(), which passes requestId = null, short-circuiting the InResponseTo check in SamlResponse#isValid:

if (requestId != null && !Objects.equals(responseInResponseTo, requestId)) { ... }

SAML_STATE now holds auth.getLastRequestId() and is passed to processResponse(requestId), so the response is checked against the AuthnRequest this SP actually issued.

This is also what the other SSO providers already do — OpenIdConnectAuthenticator compares sesState.equals(reqState), and the Entra ID authenticator validates state and nonce. SAML was the only one that checked the session attribute for presence alone.

2. No replay protection

Saml2Settings#getReplayCache defaults to null and was never set, so java-saml skipped its assertion-ID replay check entirely. A captured, still-valid SAMLResponse could be replayed until its NotOnOrAfter passed.

A single InMemoryReplayCache is now held by the authenticator and attached in getSettings(). The cache is thread-safe and evicts expired entries opportunistically, so it needs no lifecycle management.

3. Failure reasons were unreachable

if (!auth.isAuthenticated()) { logger.debug("Authentication failed."); return null; }  // always taken on failure
final List<String> errors = auth.getErrors();                                          // never non-empty here
if (!errors.isEmpty()) { ... auth.getLastErrorReason() ... }

Auth#processResponse sets authenticated = true only when isValid() returns true and appends to errors only in the else branch, so the second block could never run with content. Bad signature, expired assertion, wrong audience and wrong Destination all surfaced as a DEBUG-level "Authentication failed." with no reason — nothing at all at the default log level.

The errors and getLastErrorReason() are now logged at WARN inside the !isAuthenticated() branch. This also makes the behaviour documented in sso-saml.rst ("saml.debug=true を設定すると、SAML認証に失敗した際の詳細な理由がログに出力されます") actually happen; isDebugActive() was previously referenced only from the unreachable block.

Behaviour changes

• Concurrent SAML logins in multiple browser tabs now fail for all but the most recent AuthnRequest, since one session holds one request ID. This matches the existing OIDC behaviour.
• Sessions that still hold the old UUID at upgrade time fail once and succeed on the retry.

Test

SamlAuthenticatorTest#test_getSettings_sharesReplayCacheAcrossRequests asserts the replay cache is attached and is the same instance across calls (this also puts the previously dead setDefaultSettings helper to use).

Tests run: 15, Failures: 0, Errors: 0, Skipped: 0 -- SamlAuthenticatorTest