Basic role assignment

That's a daunting amount of new hooks, which I fear may introduce confusion about what to use when.

I haven't thought through all the details of my questions below, but some of them are informed by the structure of the D8 code.

• Say we always invoke samlauth_synchronize_saml_data_alter (i.e. independent of 'samlauth_login_sync' variable - as mentioned in #3046158-7: Sync data on each login. Then... do you need the separate samlauth_account_roles?
• and then what's the exact use for hook_samlauth_login? I don't see a lot of things that have to be done right after login instead of right before and cannot be done on hook_login.
• and can we just specify that people can throw exceptions from samlauth_synchronize_saml_data_alter, to deny login, instead of introducing hook_samlauth_auth_allowed?
• I'm not sure if hook_samlauth_attributes_alter is necessary either... if we establish that really the only use of $saml_data is to perform actions based on those data, and that we do those actions in samlauth_synchronize_saml_data_alter. I might not be seeing this correctly though.

Connected to the first bullet point:

• The second call to samlauth_set_roles_from_saml() doesn't save anything.
• However I suspect you'll find we don't need three separate calls to the function, when implementing that change changes mentioned in #3046158-7: Sync data on each login

Separately:

The use of the 'samlauth_roles_required_saml_roles' is... you want to block users who don't have a certain role, from logging in through SAML, while not blocking them from logging in locally? That's interesting, as the D8 version has it the other way around.

(Except there, it's a permission, not a role.)