Self-managed SAML Group Links and Membership Updater

What does this MR do and why?

Part one of #285150 (closed)

This change contains the basic plumbing for self-managed SAML group sync, including the policies needed to enable management of SAML Group Links via the UI, and the mechanism that will eventually call the Sidekiq worker.

Right now this change basically results in a no-op because the spot where Sidekiq would be enqueued is !85209 (diffs).

User documentation and local validation steps will come in MR two. This feature was really hard to break up into smaller MRs and have it still be reasonably testable and make sense to reviewers. Unfortunately this MR is still pretty long. I left some notes on the diff to explain a few things.

Changelog

I added a changelog because this does result in some queries being executed despite the ultimate no-op. I wasn't sure if it was strictly necessary. Happy to modify per reviewers thoughts.

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.