Allow SSO configuration to match all email addresses

### Description

As part of forcing all signin (apart from admin users) to go via SSO, we need to allow a single SSO configuration to match against all domains.

This should be a flag that only applies if there is on a single SSO provider configured or possibliy as a SSO provider of last resort (e.g. a fall through option)?

### Which customers would this be available to

Enterprise Tier Only (EE)

### Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate