To prevent security-relevant configuration mistakes, make configuration of
allowed IdP certificate fingerprints (`idpCertFingerprintAllowlist`) mandatory for
multi-ingress SSO. **This will break existing multi-ingress SSO flows until
`idpCertFingerprintAllowlist` is configured!** This breakage is unfortunately
necessary, because we're getting more lenient regarding the IdPs a user can use
to log in ("auto IdP migration"). Regular (non-multi-ingress) use cases are
unaffected.
