SAML: Allow users to enable/disable Just-in-time provisioning

### Problem Statement

Currently, when SAML SSO is enabled in Sentry, any user with access to the idp can attempt to login into Sentry and have a new account created via Just-in-time provisioning (JIT).

There are cases when admins do not want every user to be able to access Sentry, or when the organisation uses SCIM to provision/deprovision users.

### Solution Brainstorm

Add an option to allow or not users to be created via JIT provisioning.

### Product Area

Settings - Auth

Review the SAML SSO, Just-in-time provisioning, and SCIM-related settings and authentication flow first. Define where an administrator would control JIT account creation and verify that the setting prevents unauthorized new accounts while preserving the intended SAML and SCIM workflows.

Written by the indexing model from the issue text.