List SSO configurations for the tenant

Returns the Single Sign-On configuration records visible in the active scope, powering the SSO page on route load. Each record carries the enablement flag, federation protocol (SAML 2.0 or OIDC), display name shown on the sign-in button, IdP metadata URL, entity ID / issuer, the service-provider ACS (reply) URL, the X.509 signing certificate used to validate IdP assertions, the "disable local password sign-in" policy flag, the verified domains list and the last metadata sync time. The certificate field holds the public signing certificate only — no private material is ever returned. Validation: scopeId must reference a scope the caller can access (unknown → 404 NOT_FOUND); caller needs IAM read permission in the tenant (else 403 FORBIDDEN); malformed pagination parameters → 422 VALIDATION_FAILED. Async & state: Synchronous read; no state change. No SSE frames are emitted by this read. Errors: 401 unauthenticated; 403 caller lacks IAM read permission; 404 scope not found; 422 malformed query parameters; 500 read-model unavailable. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response ETag can be supplied as If-Match on the PATCH update.