fix: block SSRF in SAML metadata URL fetching (GHSA-64cv-vxpr-j6vc)

Adds `validate_saml_metadata_url()` and `SAMLMetadataURLError` to
saml_utils.py. Enforces HTTPS and blocks loopback, link-local (including
cloud metadata endpoints like 169.254.169.254), and reserved IP addresses.
RFC 1918 private ranges are blocked by default and can be opted out via
`SAML_METADATA_URL_ALLOW_PRIVATE_IPS = True` for deployments where the
SAML IdP lives on the same private network.

The validator is called in `fetch_metadata_xml()` before `requests.get()`.
A 30s request timeout is also added and the previous non-enforcing HTTP
warning is removed.

`SAMLMetadataURLError` is caught in `sync_provider_data` alongside the
existing network exceptions so validation failures return HTTP 400 rather
than 500.

Note: the equivalent fix for the `fetch_saml_metadata` Celery task in
openedx-platform was applied separately. The validator is duplicated here
rather than imported from the platform because edx-enterprise is a plugin
installed into the platform venv and does not depend on it directly.

Addresses: https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>