Okta enrollment flow does not work with the scoped token

[r0mant]

Several issues in the Okta integration enrollment flow when trying to use Okta API token that's scoped to specific apps/groups via resource set:

• Creation of the Okta SAML application fails if resource set restricts apps.
• If apps are allowed but groups are restricted, it fails when we try to fetch Everyone group.

This makes it basically impossible to use the web UI enrollment flow end-to-end. A workaround would be to create an okta-integration SSO connector beforehand but that's awkward UX.

We should:

• Fix the enrollment flow to gracefully skip SSO connector creation.
• Create a connector without group assigned if API token was created by an Okta user with admin role assigned resource set restricting groups
• Update documentation with precise instructions on how to use scoped tokens (what admin permissions are needed, how to scope resource set, SSO connector creation).

[kopiczko]

The requirements here changed. We don't want to skip SSO connector creation because we want to synchronize users - it’s a prerequisite for synchronizing groups, applications, and access lists, making it critical to maintain functionality.

The only thing that functionally changes is that we will create a connector without group assigned if API token was created by an Okta user with admin role assigned resource set restricting groups.

[kopiczko]

Done with:

• https://github.com/gravitational/teleport.e/pull/5441
• Update Okta integration docs with resource sets details #48935

And related backports