Complete ExSaml.UI: missing providers (jumpcloud/wallix), fix Azure AD labels, typo & gettext

[docJerem]

Context

ExSaml.UI (lib/ex_saml/ui.ex) is the single source of truth for the
per-provider SSO credential labels (the exact field names as shown in each
IdP's admin console) and values (value/2 for :entity_id, :acs_url,
:slo_url, :slo_response_url, :sp_metadata_url).

Dashboard v2 (apps/cryptr_dashboard) will consume ExSaml.UI directly to render
the SSO "Credentials" onboarding screen — the UI must hold no provider
knowledge, and we must not duplicate this logic in cryptr_core or elsewhere.
So ExSaml.UI should be completed to be authoritative, rather than re-ported.

Current state

labels/1 covers: saml.adfs, saml.azure_ad, saml.google,
saml.ibm_security_verify, saml.keycloak, saml.okta, saml.onelogin,
saml.ping_federate, saml.ping_one, saml.lemon_ldap, plus a fallback.

Gaps to fix (complete ExSaml.UI)

1. Missing providers — add :"saml.jumpcloud" and :"saml.wallix".
2. Azure AD labels are stale — labels(:"saml.azure_ad") no longer matches the
   real Azure portal vocabulary. Use: "Identifier (Entity ID)",
   "Reply URL (Assertion Consumer Service URL)", "Logout Url".
3. Typo — sp_metadata_url: ["SP Metdata URL"] (lemon_ldap, ~line 98; audit the
   others) → "SP Metadata URL".
4. i18n lost — labels are plain strings; restore gettext (or return
   translatable keys) so the labels are localizable.

Source of truth for the exact labels

Port the labels faithfully from the legacy
OnboardingWeb.CredentialsLabel.labels/1
(apps/onboarding_web/lib/onboarding_web/credentials_label.ex in
cryptr-platform-beta) — it has the complete, correct per-provider vocabulary
(including multi-label fields, e.g. OneLogin) that ExSaml.UI was a partial,
degraded port of. Apply the corrections above on top.

Tests

One test per provider_type asserting the exact expected labels (compare to the
legacy expected values), plus the fallback.

Related / out of scope for this issue

Certificate-format-per-provider (get_certificate_type/1 in legacy
cleeck/certificates.ex: azure_ad/keycloak → PFX, adfs/okta/… → x509 PEM, else
none) and the certificate display attrs are a separate concern — to decide
where they live (ex_saml vs cryptr_core Certificates). Not part of completing
ExSaml.UI's labels/values.