(PUP-3242) Setting up mod_shib

Lets try this one again. Rebased against master.

This PR allows the `apache` module to configure and manage `mod_shib` to allow SAML2 Shibboleth authentication of HTTPS from an IDp or from a Single Sign On Federation (like http://tuakiri.ac.nz/ ) 

I'll be doing some more work on this in the next couple of weeks, but input on the tests and code would be appreciated.

Note: Acceptance testing of `mod_shib` with beaker, or anything else may not be straight forward as it would require setting up additional VMs as an Identity Provider (IDp), another as a Directory Service (DS), and some kind of interpretive dance with x509 certificates and faking user input.