saml: Support syncing custom profile fields with SAML attributes.

Fixes #17277.

The main limitation of this implementation is that the sync happens if
the user authing already exists. This means that a new user going
through the sign up flow will not have their custom fields synced upon
finishing it. The fields will get synced on their consecutive log in via
SAML in the future. This can be addressed in the future by moving the
syncing code further down the codepaths to login_or_register_remote_user
and plumbing the data through to the user creation process.

We detail that limitation in the documentation.

zerver/lib/types.py

@@ -65,5 +65,6 @@ class SAMLIdPConfigDict(TypedDict, total=False):
     display_name: str
     display_icon: str
     limit_to_subdomains: List[str]
+    extra_attrs: List[str]
     x509cert: str
     x509cert_path: str