Moving to the new CERN SSO

This MR adapts the legacy (but currently used as production) version to use the new CERN SSO.

I freely admit, I'm not an expert here and do not really know the old system so there may be some things I have missed. So buyer beware.

It takes the relevant code from the master branch to adapt the auth systems to use the new one. Copying over the api in the current master branch also pulls in changes in endpoint responses which would require client changes. Its cleaner then to just change the sso part.

There is a test instance at https://kvm-s3562-1-ip149-30.cms for testing.

A few minor things are probably missing and probably some clean up is needed as I mostly just ripped out the Shibolth and httpd services.