[FEATURE] Support SAML 2.0 auth in Thrift HTTP protocol

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [x] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the feature

Apache Hive already has [a proposal](https://hive.apache.org/docs/latest/170266662/) - and a working implementation—for SAML 2.0 when transportMode=http:
- Server: [ThriftHttpServlet](https://github.com/apache/hive/blob/57e80a20aafdc5fe1c4e3c4851a24252fad09825/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java#L368)
- JDBC client: [HiveConnection](https://github.com/apache/hive/blob/79ec7f37fb0170acfc00dc630549d8c8090f5028/jdbc/src/java/org/apache/hive/jdbc/HiveConnection.java#L1387)

Kyuubi currently supports SPNEGO/Kerberos for Thrift HTTP but lacks first-class SAML. Adding it would unlock seamless SSO for many enterprises that rely on SAML identity providers (Okta, ADFS, Keycloak, Azure AD, etc.).

### Motivation

- Enterprise SSO compliance – Many organizations mandate SAML 2.0 for audit and centralised access control; lack of SAML blocks Kyuubi adoption.
- Parity with Hive & other SQL gateways – Feature alignment eases migration.
- Simpler client onboarding – JDBC/ODBC users can reuse browser-based or IdP-initiated login flows without Kerberos configuration.

### Describe the solution

#### Server Side
SAML Service Provider filter
1) Add a SamlAuthenticationFilter in front of ThriftHttpServlet (Jetty) that intercepts unauthenticated requests on the /cliservice/* path.
2) Use OpenSAML 3 (Apache 2.0 licence) for parsing, signing and validating SAML messages.
3) Accept both HTTP-Redirect and HTTP-POST bindings; enforce SignedAuthnRequest and SignedAssertion by default.
4) Map the asserted NameID (or a configurable attribute, e.g. email) to a Hadoop UserGroupInformation instance so that proxy user / doAs semantics keep working.
#### Client side
(will be updated later)

### Additional context

_No response_

### Are you willing to submit PR?

- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve.
- [ ] No. I cannot submit a PR at this time.

Start by comparing Hive's ThriftHttpServlet.java server implementation and HiveConnection.java client implementation, then inspect Kyuubi's existing SPNEGO/Kerberos Thrift HTTP path. The server scope covers authentication on /cliservice/*, SAML bindings and Hadoop user mapping; client-side work is explicitly deferred, so the final scope must be clarified before implementation.

Written by the indexing model from the issue text.