fix(saml): respect redirectTo URL on ACS error redirects

[yuvalkarmi]

Previously, SAML ACS errors always redirected to SiteURL, ignoring the redirectTo parameter stored in RelayState. This made it difficult to test SSO in development environments or with different redirect urls that handle sso logins.

Now handleSamlAcs returns the redirectTo URL along with errors, and SamlAcs uses it for error redirects when valid (falling back to SiteURL otherwise - so previous behavior is retained).

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

Fixes #2349

When SAML SSO authentication fails, the error redirect always goes to the configured SiteURL, completely ignoring the redirectTo parameter that was passed to signInWithSSO() and stored in RelayState.

• Success: redirects to redirectTo
• Failure: redirects to SiteURL (ignores redirectTo)

This happens because the error handler in SamlAcs (lines 48-60) hardcodes a.config.SiteURL without checking if a valid redirectTo was provided.

What is the new behavior?

Error redirects now respect the redirectTo URL when it's valid (i.e., in the redirect allow list), falling back to SiteURL only when redirectTo is empty or not whitelisted.

• Success: redirects to redirectTo
• Failure with valid redirectTo: redirects to redirectTo with error params
• Failure without valid redirectTo: redirects to SiteURL with error params

Implementation

Changed handleSamlAcs to return (string, error) instead of just error, where the string is the redirectTo URL (if determined). The SamlAcs function now uses this returned value for error redirects when valid.

Additional context

This fix allows developers to properly test SSO flows in development/staging environments that use different domains than production, and enables applications to handle SSO errors in their intended context rather than being redirected away to a different domain.