[FIX][14.0] auth_saml: Add FOR NO KEY UPDATE NOWAIT clause to SAML provider query

[Ricardoalso]

auth_saml: Add FOR NO KEY UPDATE NOWAIT clause to SAML provider query

• Enhance concurrency handling when fetching SAML provider data
• Prevent potential deadlocks by using NOWAIT
• Ensure data consistency during high-traffic scenarios

Previous attempt using the locking mechanisms

self.env.cr.execute(
    "SELECT id FROM auth_saml_provider WHERE id in %s FOR UPDATE",
    (tuple(provider_ids),),
 )

led to increased latency and deadlocks under high load.

We experienced race conditions where two simultaneous login
attempts triggered parallel updates of the idp_metadata, leading to unreleased locks.

The FOR NO KEY UPDATE NOWAIT clause addresses this issue by:

1. A weaker form of row-level locking compared to FOR UPDATE. It allows concurrent INSERT operations on child tables that reference the locked row, but prevents UPDATE and DELETE operations on the locked row
2. Failing fast if the lock cannot be acquired (NOWAIT)
3. Ensuring that only one transaction can update the idp_metadata at a time

Offical Potsgresql documentation

FOR NO KEY UPDATE
Behaves similarly to FOR UPDATE, except that the lock acquired is weaker: this lock will not block SELECT FOR KEY SHARE commands that attempt to acquire a lock on the same rows. This lock mode is also acquired by any UPDATE that does not acquire a FOR UPDATE lock.

[gurneyalex]

Can you update the commit message:

• mention the other attempts with the locks, and the issues they caused
• explain the race condition we checked together this morning with 2 login attempts that will cause 2 updates of the idp_metadata in parallel
• explain how the fix is preventing this

[gurneyalex]

/ocabot merge patch

[OCA-git-bot]

On my way to merge this fine PR!
Prepared branch 14.0-ocabot-merge-pr-716-by-gurneyalex-bump-patch, awaiting test results.

[OCA-git-bot]

Congratulations, your PR was merged at 8435445. Thanks a lot for contributing to OCA. ❤️