fix(sso): serve the SAML SP metadata before the IdP is configured

[marevol]

Problem

/sso/metadata publishes the SP metadata that the IdP is registered from, so it has to be reachable before any saml.idp.* property exists. It was not:

final Auth auth = new Auth(getSettings(), request, response);
final Saml2Settings settings = auth.getSettings();
settings.setSPValidationOnly(true);
final String metadata = settings.getSPMetadata();

The Auth constructor calls settings.checkSettings(), and spValidationOnly is still false at that point, so checkIdPSettings() runs and the constructor throws SettingsException. Setting the flag on the returned settings afterwards is too late — nothing calls checkSettings() again.

With only sso.type=saml and saml.sp.base.url set — which is exactly what the documentation says is needed to fetch the metadata — the endpoint fails:

SsoMessageException: Failed to process metadata.
  cause=SettingsException: Invalid settings: idp_entityId_not_found, idp_sso_url_invalid,
        idp_cert_or_fingerprint_not_found_and_required

leaving no way to obtain the metadata without first supplying the values the metadata is meant to help configure.

Fix

Auth is not needed here at all — getSPMetadata() is a Saml2Settings method, and neither the request nor the response is used. The settings are now built directly, setSPValidationOnly(true) is applied before validation, and checkSettings() is called explicitly so invalid SP settings are still reported rather than silently producing broken metadata.

With the flag set first, the same configuration produces valid metadata:

getSPMetadata OK, length=1358
Saml2Settings.validateMetadata(metadata) = []

Also corrects the "Failed to log out." text on the metadata validation error, which was copied from the logout path.

Tests

2 added to SamlAuthenticatorTest:

• test_getMetadataResponse_withoutIdpSettings — with only saml.sp.base.url set, a StreamResponse for metadata.xml is returned. Fails before this change with SsoMessageException: Failed to process metadata.
• test_getMetadataResponse_reportsInvalidSpSettings — an unusable ACS URL is still reported as sp_acs_not_found, pinning that dropping Auth did not drop SP validation

org.codelibs.fess.sso package: Tests run: 164, Failures: 0, Errors: 0, Skipped: 0
mvn -o clean javadoc:jar: BUILD SUCCESS
formatter:format + license:format: no changes

Independent of #3239, which touches getLoginCredential() in the same class; the two do not overlap.