IdP certificate rotation

Currently we do not have support for handling certificate rotations (both for certificates issued by the IdP and the SP).

The current plan is to support a create + delete rotation mechanism so that operators can create a new IdP configuration, perform testing to confirm it works, and then deleting the old configuration. There are a few pieces missing to be able to support this:

1. Add support for deleting an IdP configuration.
2. The name of the IdP configuration is a unique value that is used in multiple places
   • ACS Url, login elements for the silo users (urls and UI elements)
   • As a result (assuming delete was implemented) this means that certificate rotation is an outward visible change to silo users
   • Ideally to a silo user there would be no visible effect of a certificate rotation
3. If multiple IdP configurations are allowed to have the same ACS Url, how do we decide which to pick.

Part of this exercise should be mapping out the steps that we expect an operator to take when rotating certificates. I'll work on putting together some examples based on the IdPs we currently support.

Start by mapping the IdP configuration lifecycle and every use of its name in ACS URLs, silo-user login URLs, and UI elements. Then document the operator workflow for creating, testing, and deleting configurations, including how duplicate ACS URLs are selected and how rotation remains invisible to silo users.