Prevent unlinked SAML owner enabling Group Managed Accounts

What

Raise error flash when attempting to enable Group Managed Accounts (+ SSO Enforcement) if the user hasn't linked SAML for that account.

Why

A temporary fix for #38021 (closed), since not having SAML linked will result in SSO Enforcement locking the user out.

The more long term fix would be to offer to convert that user into a Group Managed Account (#13481 (closed)), but that will involve UX+frontend+backend.