fix(sso): stop swallowing Entra ID login failures at DEBUG level

[marevol]

Stacked on #3215. Base will retarget to master once that merges — review only the last commit.

Problem

EntraIdAuthenticator.getLoginCredential() caught every exception, logged it only at DEBUG,
and returned null:

} catch (final Exception e) {
    if (logger.isDebugEnabled()) {
        logger.debug("Failed to process a login request on Entra ID.", e);
    }
}
return null;

SsoAction.index() already has the right handler one frame up:

} catch (final SsoLoginException e) {
    if (ssoManager.available()) {
        logger.warn("Failed to process SSO login.", e);
        saveError(messages -> messages.addErrorsSsoLoginError(GLOBAL));
    }
    ...
}

but the inner catch meant it never ran for Entra ID. OpenIdConnectAuthenticator does not
swallow, so it gets the WARN — Entra ID was the outlier.

The practical effect: a state mismatch, a nonce mismatch, a failed token acquisition and a
Microsoft Graph outage all produce the same silent redirect to the login page, with nothing above
DEBUG to tell them apart.

Fix

Rethrow SsoLoginException unchanged, and wrap anything else in one, so both reach SsoAction.

The user-visible outcome does not change — the SSO error message, then the login page. Wrapping
rather than letting the raw exception propagate matters because the Graph client throws
CurlException, a RuntimeException, which SsoAction does not catch and which would otherwise
surface as a 500 error page.

Tests

EntraIdAuthenticator's unit test class, 2 new tests, both failing before the change:

• test_getLoginCredential_surfacesUnexpectedFailures — an IllegalStateException from
  processAuthenticationData() comes back as an SsoLoginException wrapping it
• test_getLoginCredential_propagatesSsoLoginExceptionUnwrapped — an SsoLoginException is
  rethrown as the same instance, not double-wrapped

Tests run: 140, Failures: 0, Errors: 0, Skipped: 0

(the whole org.codelibs.fess.sso package plus SsoActionTest)