saml idp endpoints: check early and consistently whether the SAML IdP is enabled

They are outside of the module so can be called when the module is
disabled, which gives an error somewhere deep in the call stack.
Check for all endpoints whether saml2-idp is enabled in config
and whether the module is enabled before doing anything else.