feat: add shared sso handoff utilities

[zdburrage]

Summary

Extracts shared SSO handoff utilities so Cognito, Auth0, and future providers can generate the same WorkOS handoff schemas.

This includes:

• Shared SAML, OIDC, custom attribute mapping, and proxy route headers
• Shared row builders with blank defaults for missing fields
• Shared CSV writer helpers and CSV escaping utility
• Shared SAML metadata parser and OIDC discovery URL normalizer
• Structured warning helpers for missing domains, redacted secrets, multi-org consolidation, and unsupported protocols
• Cognito compatibility re-exports so existing Cognito behavior remains unchanged

Impact

No user-facing Cognito CLI behavior changes. This branch moves SSO handoff primitives into reusable shared modules and keeps Cognito tests passing against the shared implementation.

Stack

This is PR 2 of 3. Merge order:

1. feat/package-contract
2. feat/sso-handoff-shared
3. feat/auth0-package-core

Base branch: feat/package-contract

Validation

• npm run typecheck
• npm run lint
• npm run format:check
• npm test
• npm run build

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.