Add query parameter support for authn requests

Closes gh-15017

docs/modules/ROOT/pages/servlet/saml2/login/authentication-requests.adoc

@@ -4,7 +4,7 @@
 As stated earlier, Spring Security's SAML 2.0 support produces a `<saml2:AuthnRequest>` to commence authentication with the asserting party.
 
 Spring Security achieves this in part by registering the `Saml2WebSsoAuthenticationRequestFilter` in the filter chain.
-This filter by default responds to endpoint `+/saml2/authenticate/{registrationId}+`.
+This filter by default responds to the endpoints `+/saml2/authenticate/{registrationId}+` and `+/saml2/authenticate?registrationId={registrationId}+`.
 
 For example, if you were deployed to `https://rp.example.com` and you gave your registration an ID of `okta`, you could navigate to:
 
@@ -12,6 +12,42 @@ For example, if you were deployed to `https://rp.example.com` and you gave your
 
 and the result would be a redirect that included a `SAMLRequest` parameter containing the signed, deflated, and encoded `<saml2:AuthnRequest>`.
 
+== Configuring the `<saml2:AuthnRequest>` Endpoint
+
+To configure the endpoint differently from the default, you can set the value in `saml2Login`:
+
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Bean
+SecurityFilterChain filterChain(HttpSecurity http) {
+	http
+        .saml2Login((saml2) -> saml2
+            .authenticationRequestUriQuery("/custom/auth/sso?peerEntityID={registrationId}")
+        );
+	return new CustomSaml2AuthenticationRequestRepository();
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun filterChain(http: HttpSecurity): SecurityFilterChain {
+    http {
+        saml2Login {
+            authenticationRequestUriQuery = "/custom/auth/sso?peerEntityID={registrationId}"
+        }
+    }
+    return CustomSaml2AuthenticationRequestRepository()
+}
+----
+======
+
 [[servlet-saml2login-store-authn-request]]
 == Changing How the `<saml2:AuthnRequest>` Gets Stored