They are outside of the module so can be called when the module is
disabled, which gives an error somewhere deep in the call stack.
Check for all endpoints whether saml2-idp is enabled in config
and whether the module is enabled before doing anything else.

.coveralls.yml has been superceded by codecov.yml. Update the release
build script to delete the new file.

Our releases published to Packagist use version numbers with a
"v"-prefix, e.g. "v1.18.7".

The build-release script overwrites this with a version number without
the "v"-prefix, e.g. "1.18.7".

The result of this is that the composer.json in our release tar-files
does not match the composer.lock file in the repository nor the
composer.json that Packagist looks at.

Fix this by prepending a "v" to the version number when updating
composer.json.

eduPerson recommends: 'Multiple "@" signs are not recommended, but in any case,
the first occurrence of the "@" sign starting from the left is to be taken as
the delimiter between components. Thus, user identifier is to the left,
security domain to the right of the first "@".'

Closes #236

This would otherwise terminate win an error because checkURLAllowed
does not accept a null parameter.