Fine grained control on SSO for each users

Enable the following configuration / restrictions for each users:

- For each users:
- can connect with any SSO configured (default)
- can connect with only the SSO enabled for each user

- For all new sign up:
- can connect any number of additional SSO configured
- can connect with only the SSO whitelisted, besides the one signed up with
- can connect with only the SSO used for signup

Start by mapping the SSO configuration, per-user restrictions, and new-signup flow described in the issue. Clarify how the three signup policies and the per-user default should interact, then identify the relevant Go entry points and tests before defining what behavior is complete.

Written by the indexing model from the issue text.