CE changes for SSO web enforcement

What does this MR do?

CE changes for https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/10034

Adds two methods for us to extend in EE:
- OmniauthCallbacksController#link_identity
- GroupPolicy#lookup_access_level!