turn off sso flag if an update removes sso options

ff-iii used to have LDAP but we removed it. in the database, 'sso'
is still true. the migration here will reset it back to false.
for future situations like these, we sync the sso flag on app update itself.

this ensures correct behavior when yet another update add back sso support.
in ff-iii case, a future update is bringing in proxyAuth based sso!

we don't store the 'sso' bit in backupdb, so user choice of sso is
lost if restore changes sso addons.

src/apps.js

@@ -1284,7 +1284,7 @@ async function install(data, auditSource) {
     let sso = 'sso' in data ? data.sso : null;
     if ('sso' in data && !('optionalSso' in manifest)) throw new BoxError(BoxError.BAD_FIELD, 'sso can only be specified for apps with optionalSso');
     // if sso was unspecified, enable it by default if possible
-    if (sso === null) sso = !!manifest.addons['ldap'] || !!manifest.addons['proxyAuth'];
+    if (sso === null) sso = !!manifest.addons?.ldap || !!manifest.addons?.proxyAuth;
 
     error = validateEnv(env);
     if (error) throw error;
@@ -1850,6 +1850,9 @@ async function updateApp(app, data, auditSource) {
         values.mailboxDomain = app.domain;
     }
 
+    const hasSso = !!updateConfig.manifest.addons?.proxyAuth || !!updateConfig.manifest.addons?.ldap;
+    if (!hasSso && app.sso) values.sso = false; // turn off sso flag, if the update removes sso options
+
     const task = {
         args: { updateConfig },
         values