Start migrating to SAML2 getters/setters

SHA-1 is still supported but needs to be configured explicitly if you need it.

This allows us to both specify the details of the policy, and also to avoid skipping sending one by setting the configuration option to false.

- Variables possibly undefined when first used.
- Usage of XMLSecurityKey class without proper namespace.

This resolves #530. There are two problems here:

- When only one SubjectConfirmation is received and it is empty, an error should be thrown. However, the error would be a not very descriptive message warning about access to a non-property in a null object. Something more descriptive should be in place.
- Additionally, in PHP 7.0 this is an error and not an exception, and then the code continues to execute, effectively allowing assertions without a proper SubjectConfirmation element. This is wrong according to the standard.

Even though the default "exact" is used by most people, and few products support anything else, there's people asking for this.

Issue a notice when the option is used nonetheless.

Closes: #432

Now we are finally using the 2.x branch of the SAML2 library, which was also migrated to use namespaces. Even though the library provides an autoloader that allows loading the classes with the old names using class aliasing, we need to do the migration in one commit (at least for most part of it). This is due to the way SimpleSAMLphp checks data types, using inheritance to check objects agains abstract or more general classes. Even though class aliasing works, there's no way to replicate those relationships, and type checks that use the old class names will fail because the aliases are virtually new classes that don't inherit from others.

This is related to #346, and closes #347. It enables richer NameIDPolicy configuration, allowing to set not only the format, but also the value for "AllowCreate".

(being respectful with occurences that might change the behaviour, i.e. default database prefixes)

This reverts commit 09c5a23f.

SHA-1 is still supported but needs to be configured explicitly if you need it.

Move SimpleSAML_Utilities::selfURLNoQuery() to SimpleSAML\Utils\HTTP::getSelfURLNoQuery() and deprecate the former.

Mark the old ones as deprecated and schedule them for removal in 2.0.

`preg_match` returns `0` if no matches are found, `FALSE` only on error. This means that with the previous check unmatching certificates would not be identified, only when the preg_match itself would error.