feat: gitlab update with SAML sso

[blancharda]

Tested and working (as well as we can with no actual custom CA) in dev.

KNOWN ISSUES:

• The swap from OIDC -> SAML caused some unexpected failures for upgrades. You can either do a fresh install OR we can walk through manually adding a couple of client scopes in the keycloak admin portal (see slack thread for details)
• The migrations job in our dev env is failing, as if the rails secret has been changed. I don't believe it HAS been changed, but we haven't been able to isolate if this is specific to our dev env, or a broader issue with the package upgrade

Given the workarounds, I recommend we push forward with the known issues to try and test on-prem in parallel.