Minor SAML/Django-CSP fixes

[tymees]

As promised, I looked into the possible Django-CSP and DjangoSAML2 issues. Turns out, nothing is broken!

So this PR is limited to a few minor changes related to all this:

• Updated the dev-project to use Django CSP 4
• Fixed an issue in DjangoSAML2 in which it could forget it's session locally
• Updated the requirements to explicitly require a DjangoSAML2 version compatible with Django-CSP 4

[tymees]

So this is the fix about forgetting sessions I talked about.

If this is not here, the SAML library doesn't set it's session cookie in local dev environments. (Because by default this requires the session-cookie secure flag to be set).

I would recommend apps to set something similar

[tymees]

Oh, btw, the new version of DjangoSAML2 is compatible with Django CSP < 4 as well. So the mandatory upgrade should not break apps with a < 4 constraint

[miggol]

Requirements borked as usual

Otherwise looks good to me! Sensible defaults

[miggol]

--find-links file:///../. cdh-django-core[all,core,dev,docs,federated-auth,files,mail,recommended,rest,vue]

Works for me here. But it's still that annoying there's no way to get this generated from requirements.in

[tymees]

I've removed the offending line; it isn't required anyways...

The problem with the absolute path seems to stem from some internal pip logic. I know poetry can actually deal with this, but switching to that might be a bit extreme...