Adds SSO session timeout of 7 days using existing timestamp stored when
signing in via group level SAML.

Uses a feature flag, :enforced_sso_expiry, to allow us to gradually roll
out the change.