Fix CSRF token leakage in SAML POST binding template

[tyage]

This PR replaces form_tag with a plain HTML <form> tag in spec/rails_app/app/views/saml_idp/idp/saml_post.html.erb.

While this template is part of the spec Rails app, it is often used as a reference for actual implementation. Using form_tag automatically includes an authenticity token, which is unnecessary for SAML POST binding and results in leaking the IdP's CSRF token to Service Providers.

This change ensures that only the required SAML parameters are sent to the SP.

[tyage]

I noticed that the code example in the wiki contains the same issue.
I also recommend updating the wiki example:

https://github.com/saml-idp/saml_idp/wiki/Rails_Integration#create-view-for-post-request-saml-response

[Zogoo]

The Saml IdP gem allows an IdP application to use its own template by overwriting the default one.
I think you can do this in your app.

[tyage]

While this should be handled at the application level, the wiki and this template are often copied as-is. Using form_tag implicitly includes an authenticity token, which then gets posted to the SP. Since this is unnecessary for SAML POST binding, adjusting the examples would provide a safer reference.

[Zogoo]

LGMT