Fix 500 when SAML authenticating at IAL2 after password reset

[mitchellhenke]

Less common, but possible path to get a 500 is (NR link):

1. Have a proofed account
2. Go to an IAL2 SAML SP and start logging in
3. Click forgot password, receive email, and change password
4. Get asked for personal key, enter it
5. Redirected to account page where you receive new personal key
6. Go to IAL2 SAML SP and start log in again
7. See a 500

This fix is similar to what we do in OIDC when facing the same circumstances:

identity-idp/app/controllers/openid_connect/authorization_controller.rb

Lines 119 to 122 in 23929e1

	def prompt_for_password_if_ial2_request_and_pii_locked
	return unless pii_requested_but_locked?
	redirect_to capture_password_url
	end

[mitchellhenke]

this is completely unrelated, but it randomly failed while working on this so I tried to make it more resilient

[solipet]

Looks good, one optional comment.

[solipet]

Could move this condition to a new method identity_needs_decryption? since it's used in two places and would match the other checks more nicely.

[mitchellhenke]

Good call, done in 69d0933!