IdPMetadataParser: unconditionally disables certificate validation for HTTPS

[aburch]

The OneLogin_Saml2_IdPMetadataParser::parseRemoteXML function allows to retrieve the metadata file over HTTPS.
However, it unconditionally disables certificate validation:

https://github.com/onelogin/php-saml/blob/4f94a76934d9900ef0bac349182907f4b7e554ae/lib/Saml2/IdPMetadataParser.php#L40

This seems a bad choice as it bypasses the reason to use HTTPS (integrity protection).

[pitbulk]

@aburch We should at least add a parameter to the parseRemoteXML method:

($url, $entityId = null, $desiredNameIdFormat = null, $desiredSSOBinding = OneLogin_Saml2_Constants::BINDING_HTTP_REDIRECT, $desiredSLOBinding = OneLogin_Saml2_Constants::BINDING_HTTP_REDIRECT, $validatePeer = false)

and then use it

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $validatePeer);

Do you want to provide a PR?

[TheJosh]

This disabling of validation is dangerous and renders this method unusable.