[Maintenance] Review use of SamlHTTPMetadataResolver

[willyborankin]

Is your feature request related to a problem?
During review of #2927, @cwperks mentioned that the main reason of why we still use HTTP commons 4 is SamlHTTPMetadataResolver which reads IDP metadata file and track the state of it.
The new version 4.3.0 still use HTTP commons 4 though.

What solution would you like?
To exclude HTTP commons 4 completely there are 2 options exists:

1. Implement our own solution which will use HTTP common 5. For that we need to extend org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver and implement almost the same logic as org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver which SamlHTTPMetadataResolver extends.
2. Try to prepare PR in Shibboleth repository with new version (do not know what is the process since repo is not GiHub one)

[stephen-crawford]

[Triage] Hi @willyborankin, thank you for opening this issue. It sounds like you have done some research and that version 5 is in the works. Please follow up on what you recommend for moving forward (wait for v5 or not).

[MaciejMierzwa]

Hi, looking into this one

[willyborankin]

Hi, looking into this one

@MaciejMierzwa, thank you. The problem can be solved with OpenSAML 5.x but the minimum JDK version for it is JDK 17, since we still support JDK 11 it is not possible to move forward with it. Here is the issue about it: #3609

[MaciejMierzwa]

Hi @willyborankin I created draft pr for the task: #3894
Feel free to take a look and make suggestions