Add missing condition for disable SSO error state, update integration test to cover the situation (#25960)

## Follow-up for https://github.com/fleetdm/fleet/pull/25843


- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>

server/service/integration_core_test.go

@@ -8407,12 +8407,12 @@ func (s *integrationTestSuite) TestModifyUser() {
 	newRawPwd = userRawPwd + "4"
 	modResp = modifyUserResponse{}
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/users/%d", u.ID), fleet.UserPayload{
+		SSOEnabled:  ptr.Bool(false),
 		NewPassword: ptr.String(newRawPwd),
 		Email:       ptr.String("moduser3@example.com"),
 		Name:        ptr.String("moduser3"),
 	}, http.StatusOK, &modResp)
 	require.Equal(t, u.ID, modResp.User.ID)
-	require.Equal(t, "moduser3", modResp.User.Name)
 
 	// as an admin, set new password that doesn't meet requirements
 	invalidUserPwd := "abc"

server/service/users.go

@@ -480,7 +480,7 @@ func (svc *Service) ModifyUser(ctx context.Context, userID uint, p fleet.UserPay
 	}
 
 	if p.SSOEnabled != nil {
-		if !*p.SSOEnabled && p.NewPassword == nil {
+		if !*p.SSOEnabled && user.SSOEnabled && p.NewPassword == nil {
 			return nil, fleet.NewInvalidArgumentError("missing password", "a new password must be provided when disabling SSO")
 		}
 		user.SSOEnabled = *p.SSOEnabled