Add Ceph dashboard SAML provider

Ceph dashboard SSO is SAML 2.0 (no native OIDC), so onboard it via an Authentik
SAML provider + application. Also resolve SAML authorization/invalidation flows
by slug and the signing keypair by name (mirrors the oauth2 handling), since the
SAML path had not been exercised before.

- config/providers_saml/ceph.yaml: SP entity id/ACS derived from the dashboard
  base URL (audience .../auth/saml2/metadata, acs .../auth/saml2, HTTP-POST),
  signed with the built-in self-signed keypair.

Ceph side (separate, Puppet): ceph dashboard sso setup saml2
  https://dashboard.ceph.unkin.net <authentik-idp-metadata-url>

Validated with `terragrunt plan`: 2 to add (provider + application).

config/providers_saml/ceph.yaml

@@ -0,0 +1,15 @@
+# SAML provider + application for the Ceph dashboard (dashboard.ceph.unkin.net).
+# Ceph dashboard SSO is SAML 2.0 (no native OIDC). The SP entity id and ACS URL
+# are derived by Ceph from its base URL:
+#   entity id (audience): <base>/auth/saml2/metadata
+#   ACS url (HTTP-POST):  <base>/auth/saml2
+# Configure the Ceph side (Puppet/mgr) with:
+#   ceph dashboard sso setup saml2 https://dashboard.ceph.unkin.net <authentik-idp-metadata-url>
+name: Ceph Dashboard
+authorization_flow: default-provider-authorization-implicit-consent
+invalidation_flow: default-provider-invalidation-flow
+acs_url: https://dashboard.ceph.unkin.net/auth/saml2
+audience: https://dashboard.ceph.unkin.net/auth/saml2/metadata
+sp_binding: post
+# Authentik's built-in self-signed keypair, resolved by name; signs assertions.
+signing_kp: authentik Self-signed Certificate