Refactor scoping code in the SP class

Make sure the `saml:IDPList` and `IDPList` parameters are not overloaded. From now on, saml:IDPList is being used when SSP is used as a proxy while the IDPList parameter is used when SSP is used as in SP-mode and you want to apply scoping to your AuthnRequest.

See https://github.com/simplesamlphp/simplesamlphp/pull/1563 for the full explanation of the changes.

modules/saml/src/Auth/Source/SP.php

@@ -531,13 +531,16 @@ class SP extends \SimpleSAML\Auth\Source
             }
         }
 
-        $IDPList = [];
         $requesterID = [];
 
         /* Only check for real info for Scoping element if we are going to send Scoping element */
         if ($this->disable_scoping !== true && $idpMetadata->getOptionalBoolean('disable_scoping', false) !== true) {
-            if (isset($state['saml:IDPList'])) {
-                $IDPList = $state['saml:IDPList'];
+            if (isset($state['IDPList'])) {
+                $ar->setIDPList($state['IDPList']);
+            } elseif (!empty($this->metadata->getOptionalArray('IDPList', []))) {
+                $ar->setIDPList($this->metadata->getArray('IDPList'));
+            } elseif (!empty($idpMetadata->getOptionalArray('IDPList', []))) {
+                $ar->setIDPList($idpMetadata->getArray('IDPList'));
             }
 
             if (isset($state['saml:ProxyCount']) && $state['saml:ProxyCount'] !== null) {
@@ -560,16 +563,6 @@ class SP extends \SimpleSAML\Auth\Source
             Logger::debug('Disabling samlp:Scoping for ' . var_export($idpMetadata->getString('entityid'), true));
         }
 
-        $ar->setIDPList(
-            array_unique(
-                array_merge(
-                    $this->metadata->getOptionalArray('IDPList', []),
-                    $idpMetadata->getOptionalArray('IDPList', []),
-                    (array) $IDPList
-                )
-            )
-        );
-
         $ar->setRequesterID($requesterID);
 
         // If the downstream SP has set extensions then use them.