Unsigned SAML logout message validation

[duanemay]

Introduce SamlUnsignedMessageValidator for unsigned SAML logout message validation.

Decodes and validates unsigned SAML requests and responses while ensuring issuer, destination, and status are checked correctly.

[Copilot]

Pull request overview

This PR adds a fallback validator to handle unsigned SAML Single Logout messages when Spring Security’s standard logout validators can’t be invoked (due to missing redirect signature parameters), while still validating key non-signature fields (issuer/destination/status).

Changes:

• Introduces SamlUnsignedMessageValidator to decode/parse unsigned logout requests/responses and validate issuer/destination (and status for responses).
• Updates SamlLogoutRequestValidator / SamlLogoutResponseValidator to bypass the Spring delegate only when signature parameters are absent.
• Updates/extends SAML-related tests and bumps the Spring Boot version in the Gradle version catalog.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/saml/SamlAuthenticationMockMvcTests.java	Refactors POST-form SAMLRequest extraction into a helper.
server/src/test/java/org/cloudfoundry/identity/uaa/authentication/SamlLogoutResponseValidatorTest.java	Adds/updates tests for unsigned logout response handling and delegate behavior.
server/src/test/java/org/cloudfoundry/identity/uaa/authentication/SamlLogoutRequestValidatorTest.java	Adds/updates tests for unsigned logout request handling and delegate behavior.
server/src/main/java/org/cloudfoundry/identity/uaa/authentication/SamlUnsignedMessageValidator.java	New unsigned-message validator for logout request/response non-signature checks.
server/src/main/java/org/cloudfoundry/identity/uaa/authentication/SamlLogoutResponseValidator.java	Adds bypass path for unsigned messages instead of calling delegate validator.
server/src/main/java/org/cloudfoundry/identity/uaa/authentication/SamlLogoutRequestValidator.java	Adds bypass path for unsigned messages instead of calling delegate validator.
gradle/libs.versions.toml	Updates the Spring Boot version reference.