Adds support for running a Shibboleth Service Provider

Note: this hasn't been enabled for the production environment yet. I also need to ensure the shib headers can't be forged. I'd like to get some feedback first, before I make those changes though.

Configurations happens through hiera by configuring:
 * `shibboleth_entity_id`        -   The entity ID of our SP (e.g.: https://sp.oaeproject.org/shibboleth)
 * `shibboleth_keyname`          -   The name of our key (e.g.: `web0`)
 * `shibboleth_subjectname`      -   The subject name of our key (e.g.: `CN=web0`)
 * `shibboleth_hosts`            -   A hash of hashes, each inner hash containing the `hostname` where it's running and the attribute that should be used for the `remote_user` variable

The certificate and key should be copied to `./modules/shibboleth/templates/sp-cert.pem` and `./modules/shibboleth/templates/sp-key.pem`. (Note: **NOT** `modules/shibboleth/files`, this is due to puppet limitations)

Supporting Shib authentication is done by installing the Shibboleth SP software and running an apache with mod_shib.

The Shibboleth metadata is also generated by this puppet work and is served by Nginx.
It's available at the typical endpoint at /Shibboleth.sso/Metadata.
Usually, it's the Shibboleth SP that outputs this metadata, but the data it outputs
does not work well in a multi-tenant environment.

There are 2 new modules included that are required to support this work:
 * puppetlabs/apache
 * puppetlabs/concat (The apache module requires it)