fix: bump lua-resty-saml to 0.2.6

[shreemaan-abhishek]

Description

Bumps the pinned lua-resty-saml dependency from 0.2.5 to 0.2.6.

0.2.6 hardens response handling so identity is only read from a
response that carries exactly one assertion, keeping the extracted
identity aligned with the verified signature. The behaviour change and
its regression test live in lua-resty-saml (api7/lua-resty-saml#32);
this PR only moves the pin.

Which issue(s) this PR fixes:

Fixes #

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change (the regression test ships in the dependency, fix: require exactly one assertion in a verified SAML response api7/lua-resty-saml#32)
• I have updated the documentation to reflect this change (dependency version bump; no docs affected)
• I have verified that this change is backward compatible