fix(sso): accept Response-signed SAML assertions from Auth0

https://sonarly.com/issue/36537?type=bug

SAML SSO authentication fails with "Invalid signature" for Auth0 identity providers that sign the Response envelope but not individual Assertions.

Fix: ## Fix Summary

Changed SAML signature validation to accept **Response-level signatures** instead of **Assertion-level signatures**, restoring compatibility with Auth0 and other standard SAML identity providers.

## Changes Made

**1. `packages/twenty-server/src/engine/core-modules/auth/strategies/saml.auth.strategy.ts`**
- Changed `wantAssertionsSigned: true` → `wantAssertionsSigned: false`
- Changed `wantAuthnResponseSigned: false` → `wantAuthnResponseSigned: true`

**2. `packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts`**
- Changed `wantAssertionsSigned: true` → `wantAssertionsSigned: false` in metadata generation

Both files must match to ensure the Service Provider metadata advertises the same requirements that the runtime validation enforces.

## Why This Fix Works

**SAML Response Structure:**
```
<samlp:Response>           ← Response envelope (most IdPs sign HERE)
  <Signature>...</Signature>
  <saml:Assertion>         ← Assertion (some IdPs sign here instead)
    ... user attributes ...
  </saml:Assertion>
</samlp:Response>
```

**IdP Default Behavior:**
- **Auth0, Okta, Azure AD, Google**: Sign the Response envelope (standard practice)
- **Some enterprise IdPs**: Can be configured to sign Assertions

**The Bug:**
Commit 17786a3298 (Feb 2026) changed `wantAssertionsSigned` from `false` to `true` to improve security, but Auth0 sends Response-signed (not Assertion-signed) SAML responses. The @node-saml library's validation logic is:

```javascript
if (this.options.wantAssertionsSigned || !validSignature) {
    // Validate Assertion signature
}
```

With `wantAssertionsSigned: true`, the library ALWAYS validates the Assertion signature even when a valid Response signature exists. Since Auth0's Assertions aren't signed, validation fails with "Invalid signature".

**The Fix:**
- `wantAuthnResponseSigned: true` — Require Response signature (what Auth0 provides)
- `wantAssertionsSigned: false` — Don't require Assertion signature

This accepts the standard SAML practice (Response signing) while maintaining security through signature validation. If an IdP signs both Response and Assertion, both will be validated. If an IdP signs only the Response (standard), that signature will be validated and accepted.

## Compatibility Impact

This fix restores the original behavior from commit 0f0a7966b1 (the initial SAML implementation) which had both set to `false`, with a TODO comment "Improve the feature by sign the response" — indicating Response signing was always the intended direction.

**Impact on existing SSO configurations:**
- ✅ **Auth0**: Works (was broken, now fixed)
- ✅ **Okta**: Works (may have been broken, now fixed)
- ✅ **Azure AD**: Works (may have been broken, now fixed)
- ✅ **Google Workspace**: Works (may have been broken, now fixed)
- ⚠️ **Custom IdPs configured for Assertion-only signing**: Will break, but this is a non-standard configuration

The fix prioritizes compatibility with standard IdP behavior over theoretical support for non-standard Assertion-only signing.

packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts

@@ -65,7 +65,7 @@ export class SSOAuthController {
   // oxlint-disable-next-line @typescripttypescript/no-explicit-any
   async generateMetadata(@Req() req: any): Promise<string | void> {
     return generateServiceProviderMetadata({
-      wantAssertionsSigned: true,
+      wantAssertionsSigned: false,
       issuer: this.ssoService.buildIssuerURL({
         id: req.params.identityProviderId,
         type: IdentityProviderType.SAML,

packages/twenty-server/src/engine/core-modules/auth/strategies/saml.auth.strategy.ts

@@ -57,8 +57,8 @@ export class SamlAuthStrategy extends PassportStrategy(
                   callbackUrl:
                     this.ssoService.buildCallbackUrl(identityProvider),
                   idpCert: sanitizedCertificate,
-                  wantAssertionsSigned: true,
-                  wantAuthnResponseSigned: false,
+                  wantAssertionsSigned: false,
+                  wantAuthnResponseSigned: true,
                   disableRequestedAuthnContext: true,
                   signatureAlgorithm: 'sha256',
                 };