Add BSO check for self-managed SAML

This is part of #513219+.

What does this MR do and why?

This MR implements Block Seat Overages (BSO) support for SAML group synchronization on self-managed instances, following the established patterns from LDAP (Add BSO check for group members (GitLab.com and... (!202425 - merged)) and SCIM (Add BSO check for self-managed SCIM (!202423 - merged)) implementations.

When BSO is enabled and seats are not available, users will be added to groups with MINIMAL_ACCESS instead of their configured access level, preventing seat overages while maintaining group memberships.

NOTE: This change is behind the :bso_minimal_access_fallback which is default disabled.

Screenshots or screen recordings

Example user Adi below was added as minimal access:

How to set up and validate locally

1. Set up a self-managed GitLab instance with a license that has seat limits
2. Enable the BSO feature flag: Feature.enable(:bso_minimal_access_fallback)
3. Configure SAML group synchronization with group links
4. Ensure the instance is at or near its seat limit
5. Trigger SAML group sync for a new user
6. Verify the user is added with MINIMAL_ACCESS instead of the configured access level

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.