LP#1989209: SSO Shibboleth logout/re-login

LP#1989209: SSO Shibboleth logout/re-login

When using Shibboleth for SSO, and global logout is disabled, logging in
after logout on the same computer can fail with a 404-Not Found. The
problem is that we need to ignore our local "don't trust Shibboleth
login" cookie in this situation.

This change also means we need to delegate SP logout, in addition to
possible IdP and/or global logout, to the Shibboleth configuration.
Therefore we always redirect to the Shibboleth logout service on
Evergreen logout (when Shibboleth SSO is enabled), and SP, IdP, and
global logout is configured and mediated by the Shibboleth and IdP
configuration.

This commit modifies the meaning of the opac.login.shib_sso.logout YAOUS
such that it is only used to decide if Evergreen timeout-forced logouts
will cause a Shibboleth logout as well.  All user-initiated logouts will
now inform Shibboleth, and the Shibboleth configuration will determine
the SSO logout degree (SP, IdP, global).

See details at
https://shibboleth.atlassian.net/wiki/spaces/SHIB2/pages/2577072384/NativeSPLogoutInitiator
and the simpler configuration option of
https://shibboleth.atlassian.net/wiki/spaces/SHIB2/pages/2577072434/NativeSPServiceLogout
for information on the Shibboleth configuration required for your local
needs.

Signed-off-by: Mike Rylander <mrylander@gmail.com>