Add option :slo_enabled to opt-out (diable) from SLO endpoints completely

[gerardo-navarro]

This pull request adds support for disabling Single Logout (SLO) in the SAML strategy by introducing a new configuration option. When SLO is disabled, the related endpoints will return an HTTP 501 Not Implemented response. The documentation and tests have been updated to reflect this new behavior.

Why this change is needed

• Addresses open redirect risk described in Open Relay in SLO #240 (Option 3).
• Many apps don’t use SLO; exposing unused endpoints increases attack surface.
• Secure-by-default: redirects/logout flow only available when explicitly enabled.

What changed

• New strategy option: slo_enabled.
• SLO endpoints short‑circuit with 501 unless slo_enabled: true.
• Specs added/reordered to cover disabled vs enabled scenarios.

How to validate locally

1. In your OmniAuth initializer:
   • Omit slo_enabled (or set false) and hit /users/auth/saml/spslo → expect 501.
   • Set slo_enabled: true, restart, hit same endpoint → previous SLO behavior (redirect/logout flow).
2. Try a crafted RelayState (e.g. ?RelayState=//attacker.test) with slo_enabled: false → no redirect (501).

[gerardo-navarro]

@fh1ch @bufferoverflow Hi 👋 Can you please have a look at this PR when you have the time.

[Copilot]

Pull Request Overview

This PR adds the ability to disable Single Logout (SLO) functionality in the SAML OmniAuth strategy by introducing a new :slo_enabled configuration option that defaults to true.

• Adds :slo_enabled option with a default value of true to maintain backward compatibility
• Returns HTTP 501 Not Implemented when SLO is disabled for both /auth/saml/slo and /auth/saml/spslo endpoints
• Includes comprehensive test coverage for the new disabled SLO behavior

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
lib/omniauth/strategies/saml.rb	Adds slo_enabled option, helper methods to check if SLO is enabled, and logic to return 501 response when disabled
spec/omniauth/strategies/saml_spec.rb	Adds test coverage for both SLO endpoints when SLO is disabled, verifying 501 status and response body
README.md	Documents the new :slo_enabled configuration option and explains how disabling SLO affects endpoint behavior

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fh1ch]

@gerardo-navarro really nice work here, thanks a lot 🙇

All good from my end, over to @bufferoverflow for the final merge.