* Replace mock-test with actual test

Add support for RFC6265bis SameSite cookie attribute

This reverts commit 6bcea51e.

* Allow list of entity ids to be loaded to better support idpList

Certain metadata sources, like mdq, were don't support loading all metadata which
prevented them from being used with idplist. This change adds support for allowing
metadata sources to load a list of entities, allowing MDQ to be used for idp list.

* Update Psalm

* Ignore DocblockTypeContradiction and RedundantConditionGivenDocblockType

* Fix Psalm-errors

* Raise minimum PHP-version to 5.6

* Update lock-file accordingly

* Fix phpunit

* Suppress Psalm-issue

* Create .appveyor.yml

* Fix tests for Windows platform

* Fix builtin webserver for Windows

* Properly kill process on Windows

Stream wrappers were assumed to be relative paths. When using a stream wrapper (e.g. s3://) it was appended to the given base path.

The old mail class uses the built-in `mail` function in PHP, and builds a payload by itself using hard-coded HTML and MIME-snippets. Let's use a library for that; PHPMailer has new dependencies and does all the heavy lifting.

Some metadata publishers offer SHA256 fingerprints to validate the
fingerprint of the certificate used to sign metadata. Allow users to
configure the fingerprinting algorithm to facilitate validation.

For backward compatibility, the default algorithm remains SHA1.

Allows sharing a valid certificate setup with SignerTest. In SignerTest,
reuse good certificate as the main certificate for signature and add a
second certificate for testSignWithMultiCertificate.

* Autoloader infinite recursion fix

Fixes simplesamlphp/simplesamlphp#1030

* Added test to ensure old autoloader behaviour is preserved

Also fixed undefined variable notice

For Redis instances that require authentication, the current Redis store does not work.  So, this commit adds optional support for utilizing the Predis password option.  It will pick up the password from the config file and pass it along when it instantiates the Predis client.

The test simply checks that adding the password option doesn't break the constructor. Since Predis parameters end up as protected, we can't verify that the instance contains the password.

Twig will always use gettext, legacy will use legacy. Twig does not
work with legacy so new ui would break if you would not also set this
option. Instead, just switch the system in use based on the usenewui
config variable.