SAML allow nexus to use email as a NameID

Currently nexus will always use the "unspecified" NameID.
With #5604 fixed there is still the issue of using something other than "unspecified" on IDP side.

IDPs such as Okta allow you to set the NameID to one of the following:

    <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
    <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>

As far as I can tell the setting on the IDP side must match what the SP side is using. For example this tool tip from the okta site also suggests that this is the case:

If we wish to support more complex setups we need to add an additional setting in the silo IDP creation flow. Additionally if we wish to allow this to be changed after the IDP has been created we need some sort of API endpoints in nexus to do so, although we need to exercise caution here as changing this setting after an IDP has been in use can result in duplicate users.

Start by tracing the silo IDP creation flow and the existing SAML NameID handling. Determine how an IDP setting and any post-creation API would fit, including safeguards for duplicate users when the setting changes. Done means the supported NameID formats and their lifecycle are defined and covered by tests.