[authsaml2] Allow to reask for authentication when a transient nameID is received.
[authsaml2] Allow to reask for authentication when a transient nameID is received.

    Up to now, the only SAML2 SP behavior of Authentic 2 when a transient
    nameID was received was to open an anonymous session.
    That corresponds to the option "Behavior with transient NameID"
    of an "identity provider options policy" set to "Open a session".

    Now we implement the option set to "Ask authentication". That allows
    to ask for a user authentication even when a valid assertion is received
    containing a transient nameID. That may have sense for instance if
    the SSO login is used only to receive signed attributes for
    users with existing accounts.

incuna/authentic,BryceLohr/authentic,BryceLohr/authentic,BryceLohr/authentic,pu239ppy/authentic2,pu239ppy/authentic2,adieu/authentic2,BryceLohr/authentic,adieu/authentic2,pu239ppy/authentic2,adieu/authentic2,incuna/authentic,adieu/authentic2,incuna/authentic,pu239ppy/authentic2,incuna/authentic,incuna/authentic