Review status code caused by SAML exceptions

[ywangd]

The methodSamlUtils#samlException(String msg, Object... args) is used to signify a SAML exception in many places. A large part of this exception is catched in SamlRealm#authenticate, where it is handled internally and not exposed directly to users.

There are however usages in many other places where this exception gets ultimately translated into a 500 status code, which does not always suitable. For example, when a SAML Request is not signed, it feels more appropriate to return 400. This issue proposes to review these usages and rationalise the status code in case of error.

[elasticmachine]

Pinging @elastic/es-security (:Security/Authentication)