Retain group members on GMA conversion

This MR prevents the removal of group members on
conversion of a group to a GMA.
This change is aimed at addressing the descructive
nature of the existing behavior
as it removes all group members as well as their
access levels.

ee/app/services/group_saml/saml_provider/base_service.rb

@@ -23,7 +23,7 @@ module GroupSaml
 
           if updated && saml_provider.enforced_group_managed_accounts? && !group_managed_accounts_was_enforced
             require_linked_saml_to_enable_group_managed!
-            cleanup_members!
+            cleanup_members! if ::Feature.enabled?(:gma_member_cleanup)
           end
         end
       end

ee/app/views/groups/saml_providers/_form.html.haml

@@ -24,8 +24,9 @@
         .form-text.text-muted.js-helper-text{ style: "display: #{'none' if saml_provider.enforced_sso?} #{'block' unless saml_provider.enforced_sso?}" }
           %span
             = s_('GroupSAML|To be able to enable group managed accounts, you first need to enable enforced SSO.')
-        .bs-callout.bs-callout-info.js-callout{ style: "display: #{'block' if saml_provider.enforced_sso?} #{'none' unless saml_provider.enforced_sso?}" }
-          = s_('GroupSAML|With group managed accounts enabled, all the users without a group managed account will be excluded from the group.')
+        - if Feature.enabled?(:gma_member_cleanup)
+          .bs-callout.bs-callout-info.js-callout{ style: "display: #{'block' if saml_provider.enforced_sso?} #{'none' unless saml_provider.enforced_sso?}" }
+            = s_('GroupSAML|With group managed accounts enabled, all the users without a group managed account will be excluded from the group.')
       .form-group
         %label.toggle-wrapper.mb-0.js-group-saml-prohibited-outer-forks-toggle-area
           = render "shared/buttons/project_feature_toggle", is_checked: saml_provider.prohibited_outer_forks, disabled: !saml_provider.enforced_group_managed_accounts?, label: s_("GroupSAML|Prohibit outer forks"), class_list: "js-project-feature-toggle js-group-saml-prohibited-outer-forks-toggle project-feature-toggle d-inline", data: { qa_selector: 'prohibited_outer_forks_toggle_button' } do

ee/spec/support/shared_examples/services/group_saml/saml_provider/base_service_shared_examples.rb

@@ -57,6 +57,18 @@ RSpec.shared_examples 'SamlProvider service toggles Group Managed Accounts' do
       expect(cleanup_members_service_spy).to have_received(:execute)
     end
 
+    context 'when member cleanup flag is turned off' do
+      before do
+        stub_feature_flags(gma_member_cleanup: false)
+      end
+
+      it 'does not invoke cleaning up of group members' do
+        service.execute
+
+        expect(cleanup_members_service_spy).not_to have_received(:execute)
+      end
+    end
+
     context 'when save fails' do
       let(:params) do
         super().merge(sso_url: 'NOTANURL<>&*^')