Test SSO metadata URL validity

Fetches metadata_url (or the saved one) and checks it is SAML IdP metadata. A URL that fails the outbound URL rules by its text alone returns 400. The fetch runs under the same outbound URL rules, re-resolved and re-checked on every redirect hop (at most 3), with a timeout and a response-size cap. Any failure (blocked destination, DNS failure, refused connection, timeout) is reported with one generic message, so the result never reveals internal hosts or ports. An unreachable URL returns 200 with valid: false.