Apache 2.4

[Cantor, Scott]

Making substantial progress on this, but a couple of questions for people
with extensive htaccess use:

I think I will clearly need to either drop or deprecate/ignore the
ShibRequireAll and AuthzShibAuthoritative commands, as they simply don't
work in the 2.4 authz model. They aren't even implementable.

It seems to me that in at least the ShibRequireAll case, trying to
"ignore" an existing command in a configuration is exactly wrong. The user
is trying to intend that the rules be ANDed together, and 2.4 won't do
that unless you configure that using the new syntax they provide for rule
combining. Ignoring the old option would at best lead to the wrong
behavior.

I'm inclined to say the same for the other option. I don't like breaking
configs, but I don't think there's a better choice here. If you want to
move, you really can't leave existing policy alone and breaking outright
on those commands seems like the best way to make sure the Require rules
get fixed to do what they're supposed to.

I think something similar may end up the case for the ShibAccessControl
option I added. With the new model, I can directly create a "require
shib-plugin" feature and just support external plugins that way, and I
think it's best to just force a migration from the old way to the new way
so that Apache's boolean logic between these different approaches works
properly.

(Note: I'm not saying SP 2.5 will break SP 2.4 config, I'm saying SP on
Apache 2.4 won't support the same authz commands as on < Apache 2.4.)

-- Scott