Guide users to upstream IdPs for certain features

[pmaier1]

Is your feature request related to a problem? Please describe.
As a user I want to change my password and I don't necessarily know where I can do that if my homeserver uses an upstream IdP with MAS.

Describe the solution you'd like
If certain features is not available on MAS when used in conjunction with an upstream IdP, we should guide users to the upstream IdP.

Describe alternatives you've considered

• not guiding users like we do today

Additional context

[teutat3s]

One example we stumbled upon is:

• Usage of singular upstream IdP keycloak with MAS
• Disallowed changing email address via account.email_change_allowed: false - it should be completely managed and verified by the upstream IdP
• Upon first login, the checkbox for changing profile information is still available. User checks box to change account information
• User gets locked out of account, error message like: email address changes not allowed

Our workaround to get out of this situation was to temporarily allow changing the email address, manually verify it via mas-cli and turn it back to false.