Allow new SSO logins in "deny" mode

The can_register check is actually only suitable for preventing new unverified registrations; in SSO mode, we normally trust the SSO provider have performed the checks and only gives us users we’re supposed to let in.

Ideally, this should be a separate set of settings to allow e.g. optionally requiring confirmation on SSO logins or to configure different levels of trust per SSO provider.

added 2 commits

• c743b6a3 - 1 commit from branch collabora/staging
• fca80a4d - Allow new SSO logins in "deny" mode

Compare with previous version

enabled an automatic merge when the pipeline for fca80a4d succeeds

merged