validator pkg: control when each validator is ran

[Jusshersmith]

Problem

With the validator abstraction work that was recently done we inadvertently started to run group validations more than we used to.

Depending on the request volume flowing through SSO running the group check again can cause issues with upstream providers.

Solution

We don't need to validate the groups again here. This pull request adds a feature to the validator package that allows us to pass in a flag whenever calling the RunValidators() function that will determine which validators we want to run in that flow.

This gives us more flexibility to control when specific validators should or shouldn't be ran.

Notes

Now that the group membership check is an official 'validator' within sso-proxy it's ran each time we call RunValidators(), whereas before when running the equivalent function the group check wasn't part of this.

Specifically, here:

sso/internal/proxy/oauthproxy.go

Line 784 in 9019d4f

errors := options.RunValidators(p.Validators, session)

Previously, we were only checking email address/domains as the group check is ran just above that when refreshing or validating the session:

sso/internal/proxy/oauthproxy.go

Line 731 in 9019d4f

ok, err := p.provider.RefreshSession(session, allowedGroups)

&

sso/internal/proxy/oauthproxy.go

Line 762 in 9019d4f

ok := p.provider.ValidateSessionState(session, allowedGroups)

[Jusshersmith]

Closing in favour of #267