Expose SAML SSO groups to Dashboard

[hardillb]

fixes #5902

Description

If enabled in the SSO provider settings this adds the list of groups to the FlowFuse User object on each SSO login.

This can then be retrieved by the nr-launcher middleware when using FF Authentication and exposed to the Dashboard

depends on FlowFuse/nr-launcher#389

DO NOT MERGE BEFORE #6003 as it contains db migration

Related Issue(s)

#5902

Checklist

• I have read the contribution guidelines
• Suitable unit/system level tests have been added and they pass
• Documentation has been updated
  • Upgrade instructions
  • Configuration details
  • Concepts
• Changes flowforge.yml?
  • Issue/PR raised on FlowFuse/helm to update ConfigMap Template
  • Issue/PR raised on FlowFuse/CloudProject to update values for Staging/Production
• Link to Changelog Entry PR, or note why one is not needed.

Labels

• Includes a DB migration? -> add the area:migration label

[codecov]

Codecov Report

❌ Patch coverage is 30.76923% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.69%. Comparing base (1407081) to head (a80f316).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
forge/ee/routes/sso/auth.js	0.00%	7 Missing ⚠️
forge/ee/lib/sso/index.js	0.00%	6 Missing ⚠️
forge/db/models/User.js	50.00%	4 Missing ⚠️
...b/migrations/20250919-01-add-sso-groups-session.js	80.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6041      +/-   ##
==========================================
- Coverage   76.75%   76.69%   -0.07%     
==========================================
  Files         378      379       +1     
  Lines       18967    18993      +26     
  Branches     4516     4522       +6     
==========================================
+ Hits        14559    14567       +8     
- Misses       4408     4426      +18     

Flag	Coverage Δ
backend	76.69% <30.76%> (-0.07%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[knolleary]

A couple additional changes needed:

1. The 'provision new user on login' route needs updating to capture the group info (the else case around line 109 in forge/ee/routes/sso/auth.js
2. The groupAssertionName property is only visible if the 'manage group membership' option is enabled. The value gets reset to blank if that option is toggled off. So as it stands, no way to enable this feature without also enabling manage group membership. Suggest the quick fix is to move the new option under the manage group membership option for now. We can move it out as an independent option if the need arises in the future,