The original question here is still unaddressed. As far as I can tell
(1) the SSO sync calls do not parse secondary emails
(2) secondary emails cannot be specified on the user by API using the /u/{username}/preferences/email route, if the “email editable” setting is not enabled, which is required for the “auth overrides email” setting typically used with sso.
This is unfortunate, as secondary emails are very useful for identifying inbound email and I have them on my sso provider. There seems to be no way to provide them to Discourse.