chore(security): SSO security review + pyOpenSSL CVE fix

[remyluslosius]

Closes Q2 Workstream G residual item: SSO security review.

Summary

Automated + manual security review of the SSO federation code. One real transitive CVE chain fixed; two defense-in-depth items filed as follow-ups (#390, #391).

Changes

• Pin `pyOpenSSL==26.0.0` in `backend/requirements.txt` — fixes CVE-2026-27448 and CVE-2026-27459 (previously pulled in as transitive `22.0.0` via pysaml2)
• Add `docs/SSO_SECURITY_REVIEW_2026-04-14.md` documenting tools run, findings, controls verified
• `.gitignore`: whitelist `docs/SECURITY_REVIEW.md` and `docs/OW_SECURITY_ASSESSMENT.md` so security review artifacts are tracked for audit trail

Tool results

Tool	Scope	Findings
Bandit 1.9.4 (high+medium)	SSO code (650 LOC)	0
Bandit (any severity)	SSO code	1 (B105 false positive on `"bearer"` literal — OAuth2 standard)
Semgrep p/security-audit + p/owasp-top-ten + p/jwt + p/python	SSO code	0 findings / 205 rules
pip-audit	SSO dep subgraph	2 real CVEs on pyOpenSSL 22.0.0 — fixed in this PR

Manual review — positive controls confirmed

Area	Finding	Location
State parameter	256-bit `secrets.token_urlsafe(32)`, single-use, PostgreSQL-backed	`provider.py:102-111`
PKCE	S256 enforced	`oidc.py:39`
id_token signature	Verified against JWKS, `alg=none` rejected	`oidc.py:84-90`
Standard claims	`iss`, `aud`, `exp`, `nbf` validated	`oidc.py:93`
SAML assertion signature	`want_assertions_signed: True`	`saml.py:123`
SAML AuthnRequest signature	`authn_requests_signed: True`	`saml.py`
Audit logging	All SSO outcomes logged via `log_login_event`	`sso.py`
Client IP	Uses trusted proxy validation	`sso.py:38-42`
Encryption at rest	Provider configs encrypted via `EncryptionService`	`sso.py:50-56`

Deferred findings (follow-up issues filed)

• SEC-SSO-02: Add OIDC nonce as defense-in-depth #390 SEC-SSO-02: Add OIDC nonce as defense-in-depth (LOW — mitigated by state + PKCE)
• SEC-SSO-03: Cache JWKS instead of fetching on every callback #391 SEC-SSO-03: Cache JWKS instead of fetching on every callback (LOW — performance + availability)

Neither is exploitable given existing controls; both are improvements.

Governance

This review is not a human security sign-off substitute for operational trust decisions:

• IdP metadata trust (operator responsibility)
• Role mapping review (per-IdP, per-deployment)
• Session timeout policy (12h absolute, applies equally to SSO + local auth)

Test plan

• Scan tools executed and documented
• Manual code review completed (5 files, 818 LOC)
• Follow-up issues filed (SEC-SSO-02: Add OIDC nonce as defense-in-depth #390, SEC-SSO-03: Cache JWKS instead of fetching on every callback #391)
• CI pipeline passes on this PR