Update `Saml2RelyingPartyRegistrationConfiguration` so that `RelyingPartyRegistrations` uses `collectionFromMetadataLocation` rather than `fromMetadataLocation` and searches candidates for a matching entity ID. Prior to this commit, it was possible for the wrong provider to be used if multiple candidates existed in the returned metadata. See gh-35902