Retain group members on GMA conversion

This MR prevents the removal of group members on
conversion of a group to a GMA.
This change is aimed at addressing the descructive
nature of the existing behavior
as it removes all group members as well as their
access levels.

ee/app/services/group_saml/saml_provider/base_service.rb

@@ -23,7 +23,7 @@ module GroupSaml
 
           if updated && saml_provider.enforced_group_managed_accounts? && !group_managed_accounts_was_enforced
             require_linked_saml_to_enable_group_managed!
-            cleanup_members!
+            cleanup_members! if ::Feature.enabled?(:gma_member_cleanup)
           end
         end
       end

ee/app/views/groups/saml_providers/_form.html.haml

@@ -24,6 +24,7 @@
         .form-text.text-muted.js-helper-text{ style: "display: #{'none' if saml_provider.enforced_sso?} #{'block' unless saml_provider.enforced_sso?}" }
           %span
             = s_('GroupSAML|To be able to enable group managed accounts, you first need to enable enforced SSO.')
+        - if Feature.enabled?(:gma_member_cleanup)
           .bs-callout.bs-callout-info.js-callout{ style: "display: #{'block' if saml_provider.enforced_sso?} #{'none' unless saml_provider.enforced_sso?}" }
             = s_('GroupSAML|With group managed accounts enabled, all the users without a group managed account will be excluded from the group.')
       .form-group

ee/spec/support/shared_examples/services/group_saml/saml_provider/base_service_shared_examples.rb

@@ -57,6 +57,18 @@ RSpec.shared_examples 'SamlProvider service toggles Group Managed Accounts' do
       expect(cleanup_members_service_spy).to have_received(:execute)
     end
 
+    context 'when member cleanup flag is turned off' do
+      before do
+        stub_feature_flags(gma_member_cleanup: false)
+      end
+
+      it 'does not invoke cleaning up of group members' do
+        service.execute
+
+        expect(cleanup_members_service_spy).not_to have_received(:execute)
+      end
+    end
+
     context 'when save fails' do
       let(:params) do
         super().merge(sso_url: 'NOTANURL<>&*^')