Warn that SAML NameID must not change

What

Improve documentation for GroupSAML and possibly also for instance SAML

Document a strong bold warning that changing NameID configuration will break SAML SSO
Where we recommend using objectid as the NameID we should also note not to change an existing value if users have already signed in.
Re-arrange docs so NameID section immediately follows initial configuration instead of being after enforcement and group managed sections

Changing NameID configuration leads to SAML users being unable to log in as well as SCIM creating duplicate users.