Add API Support for IdP-Scoped SAML Group Links

This is a follow-up to IdP-Scoped SAML Group Synchronization (#517368 - closed).

Problem

The IdP scoping feature from #517368 (closed) only works in the UI. Customers managing group sync via API cannot set provider scoping, which is "crucial" for automated workflows.

This was raised by this comment.

Proposed solution

Add provider parameter to existing SAML group links API endpoints:

• Optional field for create/update operations
• Backward compatible (null = existing behavior)
• Include in API responses
• Update API documentation