Move :enforced_sso flag check to model

What

Moves the :enforced_sso flag from can_add_user? to the model.

Why

Makes it easier to use in other areas where we enforce SSO

Conformity

• Code review guidelines