Support SAML groups via attribute

In the SAML provider, it would be great if Groups were implemented. IIUC, there could be code in the saml identity provider that reads a group membership from the SAML attributes, and the IDP/SP need to be configured to pass on that group membership.

Start by inspecting the SAML identity provider implementation and how the project represents groups for other providers. Determine how SAML attributes and IDP/SP configuration should provide group membership, then verify that groups are exposed consistently through the authentication flow.

Written by the indexing model from the issue text.