Fix SAML validation behind reverse proxy with webroot

[rodo6502]

Description

Fix SAML response validation when Nextcloud is exposed below a non-root path behind a reverse proxy.

For example, Nextcloud may be externally available at:

https://cloud.example.com/nextcloud

while the reverse proxy forwards the SAML ACS request internally without the /nextcloud prefix:

/apps/user_saml/saml/acs

php-saml derives the current SAML endpoint URL from PHP server variables during response validation. In this setup, the externally visible Nextcloud webroot is missing from those variables, which can cause the calculated URL to differ from the Destination in the SAML response.

Solution

Configure php-saml with Nextcloud's webroot before initializing the SAML authentication handler:

Utils::setBaseURLPath(\OC::$WEBROOT);

This makes php-saml take the external path prefix into account when constructing the routed SAML endpoint URL.

Example:

Internal request:
  /apps/user_saml/saml/acs

Nextcloud webroot:
  /nextcloud

Resulting routed URL:
  https://cloud.example.com/nextcloud/apps/user_saml/saml/acs

This uses php-saml's base URL path handling instead of modifying PHP request server variables.

Testing

Added a unit test verifying that assertionConsumerService() configures php-saml with Nextcloud's webroot before initializing the SAML authentication handler.

The relevant controller test suite passes:

Tests: 20, Assertions: 63

The behavior was also verified with php-saml 4.3.2: with /nextcloud configured as the base URL path, getSelfRoutedURLNoQuery() produces the externally visible ACS URL including the /nextcloud prefix.

Related to #189