Minor SAML/Django-CSP fixes

[tymees]

As promised, I looked into the possible Django-CSP and DjangoSAML2 issues. Turns out, nothing is broken!

So this PR is limited to a few minor changes related to all this:

• Updated the dev-project to use Django CSP 4
• Fixed an issue in DjangoSAML2 in which it could forget it's session locally
• Updated the requirements to explicitly require a DjangoSAML2 version compatible with Django-CSP 4

[tymees]

So this is the fix about forgetting sessions I talked about.

If this is not here, the SAML library doesn't set it's session cookie in local dev environments. (Because by default this requires the session-cookie secure flag to be set).

I would recommend apps to set something similar

[tymees]

Oh, btw, the new version of DjangoSAML2 is compatible with Django CSP < 4 as well. So the mandatory upgrade should not break apps with a < 4 constraint