[web] [b2b] mark selected schemas as non-strict (#36780)

Two of the B2B request schemas flagged in #36577 reject bodies we don't
want to reject:

- POST /manage/groups/:id/settings/sso: the group settings frontend
  spreads the SSO config document it fetched from the GET route back into
  the POST body, so the request carries `_id`, `__v`, `validated`,
  `enabled` and `useSettingsUKAMF` that the handler recomputes or ignores.
- POST /manage/groups/:id/invites: an internal script sends an unsupported
  `expiresAt` alongside the email; the handler only reads `email`.

Swap z.strictObject() for z.object() on both, with a comment on each
explaining why it's deliberately non-strict.

GitOrigin-RevId: 5ff94ded579bdda07efc59d9ceb1d495964a912d

services/web/app/src/Features/Subscription/TeamInvitesController.mjs

@@ -32,8 +32,10 @@ const rateLimiters = {
   }),
 }
 
+// non-strict: evidence of scripts interacting with this that harmlessly send
+// extra, ignored fields, see https://github.com/overleaf/internal/issues/36577
 const createInviteSchema = z.object({
-  body: z.strictObject({
+  body: z.object({
     email: z.string(),
   }),
 })