Block SCIM token generation when group SAML is disabled

What does this MR do and why?

When a group's SAML integration is disabled (or was never configured), the Generate a SCIM token button and section still show on the SAML SSO settings page, and clicking it successfully generates a working-looking token — but SCIM provisioning silently fails, since it requires SAML to be enabled.

Root cause

Groups::ScimOauthController's guards don't check what they look like they check:

• check_group_saml_available! resolves via EE::Groups::ApplicationController#method_missing (pattern check_(.*)_available!) to check_group_feature_available!(:group_saml), which checks whether group_saml is licensed for the instance — not whether this group's SAML is enabled.
• check_group_saml_configured checks Gitlab::Auth::GroupSaml::Config.enabled?, which checks whether the group_saml omniauth strategy is configured instance-wide — again, not per-group.

Neither guard ever reads group.saml_provider&.enabled?. Confirmed by extending the existing controller spec with a case that has no SamlProvider at all — token creation still succeeds today.

The view (ee/app/views/groups/saml_providers/show.html.haml) has the same gap: the SCIM Token section renders unconditionally, with no check on @saml_provider&.enabled?.

Fix

• Added check_group_saml_provider_enabled! to the shared SamlAuthorization concern, mirroring the pattern already used correctly elsewhere in the codebase: Groups::SsoController#require_enabled_provider! does unauthenticated_group.saml_provider&.enabled?. Wired it into Groups::ScimOauthController.
• Wrapped the SCIM Token section in the view with - if @saml_provider&.enabled?, so the button only shows when it would actually work.

Screenshots

Both taken on a local GDK against a group with a SamlProvider that has sso_url/certificate_fingerprint set but enabled: false (SAML never turned on for the group).

Before — SCIM Token section and "Generate a SCIM token" button are shown even though SAML is disabled:

After — SCIM Token section shows disabled with an explanation when the group's SAML provider isn't enabled (Configuration and Microsoft Azure Integration sections included for context, per jagood's ask):

Also — if a SCIM token already exists when SAML gets disabled, it stays visible (with a warning that it can't be reset until SAML is re-enabled) instead of disappearing — an admin should always be able to see that a live SCIM credential exists:

Disclosure

Root-cause tracing, the fix, and tests were done with AI assistance (Claude), verified via the test suite (TDD — the regression tests were confirmed red before implementing) and by reading the actual controller/concern/view code referenced above rather than assuming behavior. Along the way, traced check_group_saml_available! through a method_missing-based DSL to confirm what it actually checks, since a naive read of the method name is misleading.

How to set up and validate locally

bin/rspec ee/spec/controllers/groups/scim_oauth_controller_spec.rb
bin/rspec ee/spec/requests/groups/saml_providers_controller_spec.rb

Closes #602492