Allow SAML to identify external users and set them as such
Related to #4009
Fixes #14577
This allows SAML to retrieve group information form the `SAML Response`
and match that to a setting that will flag all matching users as external.
See merge request !3530
