utils: add invenio_saml-compatible account-setup

[martinobersteiner]

adds tugraz_account_setup, which can add the tugraz_authenticated role to users after they log in via SAML

to enable this for a specific IdP, add it to its configuration as follows:

SSO_SAML_IDPS = {
    ...
    "<idp-name>": {
        ...
        "acs_handler": acs_handler_factory("idp", account_setup=tugraz_account_setup),
        // add here to enable new account-setup   ^
    }
}