Upgrade simplesamlphp/saml2 from v4 to v5/v6

Currently pinned to >=4.16.16 <4.20. v5 renames the library namespace from SAML2\ to SimpleSAML\SAML2\. That breaks every file here using the old namespace.

Scope

• 44 files under src/ currently do use SAML2\..., across Certificate, Compat, Configuration, Response\Processor, Utilities, XML\saml.
• Class structure mostly survives the rename. Compat/AbstractContainer, ContainerSingleton, MockContainer still exist in v5 at the same relative paths. Not a full rewrite.
• Not yet verified: whether method signatures inside those classes also changed between v4 and v5/v6. Needs checking during the migration, not assumed clean.

Why now
Two advisories against v4.x are currently suppressed via composer.json audit-ignore, mitigated in application code (SignatureTransformGuard, unreachable HTTP-Artifact path). Both stay mitigated regardless of this ticket. This is about moving off an aging major version, not an urgent security fix.

Acceptance criteria

• Bundle builds and tests pass against simplesamlphp/saml2 v5 or v6.
• All 44 use SAML2\... imports updated to SimpleSAML\SAML2\... (or later, if API changed further).
• Downstream consumers (Stepup-Gateway, Stepup-gssp-bundle, engineblock, GSSPs) confirmed compatible or updated.

Raised from review discussion on #137.

Start with composer.json and the 44 files under src/ that import SAML2\ classes, including Certificate, Compat, Configuration, Response\Processor, Utilities, and XML\saml. Check the v5/v6 method-signature changes and run the bundle build and tests while updating the imports. Done means the bundle passes against v5 or v6 and downstream consumers are confirmed compatible or updated.