Move some omniauth callback tests to request specs

What does this MR do and why?

These tests were added recently by !101321 (merged) and it was noted that they should have been implemented in requests specs instead of controller specs. This MR addresses that feedback.

I also noticed that an existing spec helper is drawing the SAML callback route at a wrong path, ending in /saml instead of /saml/callback. I fixed that since I would otherwise have had to write my tests posting to /saml which is incorrect and confusing.

Resolves #382126 (closed)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.