Route bindings do not match metadata

Summary

After some discussion in https://github.com/OpenConext/Stepup-Gateway/pull/493, @MKodde and I took a look at the bindings in Gateway. It seems gateway could accept POST requests, where only GET requests should be supported.
Using the POST in those scenario's is unsupported, and if it works, it might break as it has no test coverage.

Proposal: Remove POST from /authentication/single-sign-on and /second-factor-only/single-sign-on.
Let's refine. If the POST cannot be removed, add test coverage.

Details

Taking a look at the bindings specified in the various metadata endpoints:
https://sa-gw.surfconext.nl/authentication/metadata

🟢 /authentication/consume-assertion

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sa-gw.surfconext.nl/authentication/consume-assertion" index="0"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep consume-assertion
  gateway_serviceprovider_consume_assertion           POST       /authentication/consume-assertion

Issue: None

🔴 /authentication/single-sign-on

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sa-gw.surfconext.nl/authentication/single-sign-on"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep single-sign-on   
  gateway_identityprovider_sso                        GET|POST   /authentication/single-sign-on                      
  gateway_identityprovider_sso_proxy                  POST       /authentication/single-sign-on/{idpKey}
...

Issue: The api route accepts both POST and GET requests. The metadata only accepts the HTTP-Redirect (GET) binding. If POST requests were to be sent to this endpoint, the behavior is unsupported.

---

https://sa-gw.surfconext.nl/second-factor-only/metadata

🔴 /second-factor-only/single-sign-on

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sa-gw.surfconext.nl/second-factor-only/single-sign-on"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep single-sign-on   
...                 
  gateway_second_factor_only_identityprovider_sso     GET|POST   /second-factor-only/single-sign-on

Issue: The api route accepts both POST and GET requests. The metadata only accepts the HTTP-Redirect (GET) binding.

---

https://sa-gw.surfconext.nl/gssp/tiqr/metadata

🟢 /gssp/tiqr/single-sign-on

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sa-gw.surfconext.nl/gssp/tiqr/single-sign-on"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep gssp             
  gssp_verify                                         GET        /gssp/{provider}/single-sign-on                     

🟢 /gssp/tiqr/consume-assertion

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sa-gw.surfconext.nl/gssp/tiqr/consume-assertion" index="0"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep gssp             
  gssp_consume_assertion                              POST       /gssp/{provider}/consume-assertion                  

Issue: None.

---

Start with the bin/console debug:route output for gateway_identityprovider_sso and gateway_second_factor_only_identityprovider_sso, then trace those route entry points to their definitions. Confirm that the two metadata-declared HTTP-Redirect endpoints accept only GET, or add coverage if POST must remain supported.