Restrict CAS log in to roles

Reroll for 2.x branch (based on 2.0.0-rc1).

Update target branch. The 8.x-1.x branch is no longer supported.

Added tasks as this needs tests and an update for existing installs.

Patch prevent anon users from accessing login when providing a service which would have been a large breakage for most situations. Kept that check there, but wrapped it to only check for auth users, and then adding a new check during login pre-auth.

Fixed existing tests by adding the required permission but should review to see there are more to add permissions based tests to.

Greater test coverage.

Needs review and confirmation on the anon user access check. This diverges from the original patch in many ways, but functionally the huge difference is that it doesn't access check anonymous users. Access checking anon users seems to have been a bug as it breaks CAS functionality.

NB Failed tests: These will need to be re-run once testing infrastructure is up and running again. Database server appears to be rejecting connections at present.

Updating remaining tasks.

Test failure is caused by random label not being shown in options list.

Options list: (~o)>
Label is: (~o)>&{{

Adds the role restriction feature:

✨ Restrict CAS log in to roles Needs review

An update keeps existing behaviour of all accounts being able to access all services.

--

Still @todo: Merge into 2.1.x branch

De-assign.

Automatically closed - issue fixed for 2 weeks with no activity.