RANGER-5725: Remove SSO filter in Ranger Admin

[kumaab]

What changes were proposed in this pull request?

This PR completely removes the legacy Knox SSO authentication mechanism (RANGER-685) from Ranger Admin, which is no longer used in practice now that JWT/Bearer-token authentication (RANGER-3739) is handled by the shared ranger-authn framework.

Root problem addressed: the ranger.sso.enabled flag was overloaded — it drove JWT user auto-provisioning, audit auth-type classification, and the auth-provider branch. This caused operational bugs (e.g. an empty <value></value> public key silently breaking unrelated auth flows, and header/JWT user provisioning being coupled to an unrelated "SSO" flag).

Backend:

• Removed the ranger.sso.enabled flag and everything it drove: the SSO branch in RangerAuthenticationProvider (isSsoEnabled/setSsoEnabled/getSSOAuthentication), RangerBizUtil.isSSOEnabled(), ServiceREST.checkSSO() (/checksso), UserSessionBase.isSSOEnabled, and the locallogin scaffolding in RangerAuthenticationEntryPoint, RangerJwtAuthWrapper, and RestUtil.
• Decoupled user auto-provisioning from ranger.sso.enabled. SessionMgr now provisions absent users based on the actual authentication mechanism of the request (SPNEGO/Kerberos, trusted-proxy header, JWT, or the internal healthcheck user). RangerJwtAuthFilter sets a jwtAuthenticated request attribute that also drives AUTH_TYPE_SSO audit classification for token logins.
• JWT (RANGER-3739) config namespace moved from ranger.sso.* to ranger.admin.jwt.*, with a transparent backward-compatible fallback to the legacy ranger.sso.* names so existing JWT deployments keep working. JWT now activates automatically when a provider URL or public key is configured (no separate enable flag), and empty-string config values are correctly treated as unset.

Config:

• Replaced the Knox ranger.sso.* block with the ranger.admin.jwt.* namespace in ranger-admin-site.xml, install.properties, and setup.sh; removed sso_enabled=true from the docker admin install properties.

UI (React):

• Removed the Knox SSO flows: checkKnoxSSO/plugins/checksso, the /knoxSSOWarning route and checkSSOTrue error page, and the /locallogin route. Logout now simply clears state and redirects to login.jsp.

Intentionally kept (not part of Knox admin SSO): the AUTH_TYPE_SSO DB enum for historical audit records, RestUtil.constructForwardableURL/constructRedirectURL (used by Kerberos logout), and the entire ranger-knox-plugin (Knox authorization).

How was this patch tested?

• mvn test-compile for security-admin (main + test sources) passes.
• Ran the affected unit-test classes with no failures: TestRangerAuthenticationProvider, TestSessionMgr, TestRangerBizUtil, TestRangerSecurityContextFormationFilter, TestRangerJwtAuthFilter, TestRangerJwtAuthWrapper, TestRangerAuthenticationEntryPoint, TestRangerKRBAuthenticationFilter, TestRangerCSRFPreventionFilter, and TestServiceREST. Existing tests were updated to reflect the mechanism-based auth-type/provisioning behavior and the removed SSO endpoints/flags.
• Verified the project Checkstyle configuration (dev-support/checkstyle.xml, including test sources) passes for the security-admin module.
• Confirmed no dangling references remain to the removed symbols and ranger.sso.* properties across the repository.
• More tests - Pending.