Ensure SAML POST requests preserve an existing session

[orenyk]

Currently, an external POST request to the IdP will not have access to
an existing session since the cookie is blocked due to SameSite=Lax.
This results in users with an active session having to sign in again if
sent back to the IdP with a POST SAML request.

However, if the POST request comes from the IdP the session will be
available in that request. Therefore, this commit inserts a new action
within our SAML POST handling that captures the SAML parameters of the
original POST request, populates a form with them (with appropriate CSRF
handling), and then submits that form with JS to create an "internal"
POST request with access to the session. This new action skips session
handling so it does not override an existing IdP session cookie.

[orenyk]

@jmhooper @zachmargolis so this test works (e.g. fails when we don't update the path in the concern) but only when the routes are reordered a little so that the get comes after the post. I think this has to do with the fact that RSpec looks for a match in the routes file but doesn't check the HTTP verb, so if the get comes first it actually sets the request path to /api/saml/auth2021, even though this controller action is handled by /api/saml/authpost2021 when post is used.

[jmhooper]

Had a comment about a test, but think this should work otherwise