Want DB constraints preventing bad combination of silo settings (e.g., local + saml)

A low priority correctness improvement I noticed while reviewing something else.

In the silo create request body, the user can specify an identity mode — LocalOnly, SamlJit, or SamlScim — and that mode is then translated into two other properties corresponding to DB columns: authentication mode and user provision type. Because the identity mode can only be passed at silo create time and cannot be updated, this is more or less guaranteed to be correct because the only way that these database columns can be set is by being processed through the below code.

https://github.com/oxidecomputer/omicron/blob/5d08d2fdec25807e367ff6cab043a0b27b30228e/nexus/types/src/external_api/shared.rs?plain=1#L195-L236

However, it would be an easy extra layer of safety to put in constraints in the DB that guarantee you can't accidentally mess up that code.

https://github.com/oxidecomputer/omicron/blob/1c69391b81db0eb1dd787931154753e94a74e1f8/schema/crdb/dbinit.sql#L864-L883

We do similar things elsewhere.

https://github.com/oxidecomputer/omicron/blob/1c69391b81db0eb1dd787931154753e94a74e1f8/schema/crdb/dbinit.sql#L914-L930

Start with the identity-mode mapping in nexus/types/src/external_api/shared.rs, then inspect the related table definitions in schema/crdb/dbinit.sql, including the nearby examples of existing constraints. Add database constraints that enforce the valid authentication-mode and user-provision-type combinations, and verify that schema initialization accepts the valid combinations while rejecting invalid ones.