Silo groups could be leaked after silo delete

[jmpesp]

If a caller is racing a request to create a silo group (which currently could happen during a SAML+JIT login, or when a silo is created) and a request to delete a silo, depending on the ordering of DB queries, Nexus could create a silo group after the silo had been deleted, and return it, instead of returning a 404. There's nothing in the silo group ensure query that checks if the parent silo is undeleted.