Related to #10741, this adds a new key to app config named `end_user_authentication`, which can be configured using the same keys as the existing SSO feature. Per the spec, if the feature is configured, it's implicitly enabled, at least until we get to #10999. Note that this only enables the SSO config, a second part of the ticket with endpoints for the EULA will be tackled separately.