Signature validation failed. SAML Response rejected

### Self-Hosted Version

25.12.1

### CPU Architecture

x86_64

### Docker Version

27.4.1

### Docker Compose Version

v2.36.2

### Machine Specification

- [X] My system meets the minimum system requirements of Sentry

### Installation Type

Brand new installation

### Steps to Reproduce

I use Cadoor as SAML. I confirm that the certificate, ID, and Secret are all correct.

I checked the SAML 2.0 specification. The specification is summarized as follows:

1. The specification requires at least one signature (response or assertion) - both signatures comply with the specification, and it is recommended to do so.
2. Modern SAML service providers support dual signatures (response + assertion).
3. Service providers (SPS) that only verify response signatures will continue to function properly - additional assertion signatures are optional for verification.
4. For enterprise deployments, always signing assertions is actually the best security practice.

Casdoor uses Fortinet as its SAML application. By default, the Fortinet firewall requires that both responses and assertions be signed. That is to say, when SAML providers sign both responses and assertions, Sentry does not handle this part.

### Expected Result

sentry can support SAML where both responses and assertions are signed, or we can choose which way to use through variables

### Actual Result

09:44:55 \[INFO\] sentry.access.api: api.access (method='POST' view='sentry.web.frontend.auth_organization_login.AuthOrganizationLoginView' response='302' is_frontend_request='True' path='/auth/login/kr36/' caller_ip='[xxx.xxxx.xxx.xxx]()' user_agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36' rate_limited='False' request_duration_seconds='0.020376205444335938' rate_limit_type='DNE')
09:44:56 \[WARNING\] sentry.auth: sso.login-pipeline.error (flow=1 provider='saml2' error_message='单点登录SAML SSO失败，Signature validation failed. SAML Response rejected' organization_id=1)
09:44:56 \[INFO\] sentry.access.api: api.access (method='POST' view='sentry.auth.providers.saml2.provider.SAML2AcceptACSView' response='302' is_frontend_request='True' path='/saml/acs/kr36/' caller_ip='[xxx.xxx.xxx.xxx]()' user_agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36' rate_limited='False' request_duration_seconds='0.04005312919616699' rate_limit_type='DNE')

### Event ID

*No response*

Start at sentry.auth.providers.saml2.provider.SAML2AcceptACSView and trace the SAML validation path that emits “Signature validation failed.” Reproduce the login with a response and assertion that are both signed, then determine the supported configuration boundary. Done means the requested dual-signature SAML login works with regression coverage for this case.

Written by the indexing model from the issue text.