Remove GET request support from Saml2AuthenticationTokenConverter

[jzheaux]

Saml2AuthenticationTokenConverter tests if the HTTP method is GET in order to correctly translate SAMLResponse parameter.

However, neither the SAML spec nor Spring Security support processing the <saml2:Response> in a GET request. As such, we should remove this to alleviate confusion.

To keep upgrade passive, the first step is to add a property that defaults to true:

public void setShouldInflateResponse(boolean shouldInflate);

In Spring Security 8, this can be deprecated and switched to false, then in Spring Security 9 it can be removed.

• Add setShouldInflateResponse
• Deprecate setShouldInflateResponse

[jzheaux]

Closing in favor of #17108