Read spidL from SAMLRequest Authentication Extensions (highest priority)

[Copilot]

spidL was only extracted from referer, relay state, or wctx query strings. This adds support for reading it directly from the Extensions element in the SAMLRequest, taking precedence over all other sources.

Changes

• SPIDOptions — New configurable SpidLElementName property (default: "ext:spidL"), paired with the existing ExtensionsElementName ("samlp:Extensions"). Both are now surfaced in appsettings.json.
• RequestSAMLAsXMLExtensions — New GetSpidLFromExtensions() extension method, following the same pattern as GetSpidACSFromExtensions(). Handles both prefixed (ext:spidL) and unprefixed element names.
• ISPIDService / SPIDService — GetSPIDLValue gains an optional XmlDocument requestAsXml parameter. When provided, Extensions are checked first; validity rules (ValidSPIDL list) apply equally to this path. Falls back to existing referer → relaystate → wctx → default chain on miss or invalid value.
• FederatorRequestService — Passes requestAsXml to GetSPIDLValue.

Priority order (updated)

1. ext:spidL inside samlp:Extensions of the SAMLRequest ← new
2. Referer query string
3. RelayState query string
4. WCTX query string
5. Configured default

Example SAMLRequest fragment that will now be honoured:

<samlp:Extensions>
  <ext:spidL xmlns:ext="...">2</ext:spidL>
</samlp:Extensions>