[WIP] Implement (optional) authentication via Shibboleth instead of built-in SAML

[pauldekkers]

Currently the authentication is done via SURF's stepup bundle (integrating saml2 from SimpleSAMLphp in Symfony); this can be a bit limited, and some people may prefer to have the webserver (and entire application) protected by mod_shib, or some other authentication module such as mod_auth_oidc that provides a REMOTE_USER variable to the application.

This is a rough proposal to do this, but it is not configurable.
Nelmio was disabled since it wasn't reachable anyway when the server was protected by Shibboleth.

Todo:

• Make this optional
• Include a config example for Shib SP and Apache (and where to put it)
• Decide on reachability of Nelmio (in production)
• Decide whether this is a good idea at ;-)