Single Log Out saml-slo-enabled defsetting (#44794)

* stop using strings for enum values (prefer kw)

* only do SLO when saml-slo-enabled is true

* make defsetting docstring formatting consistent

* log-direction is a string

* add test for enabling / disabling saml slo

- also return a 403 when the client tries, but it's disabled