Debian 10: DLA-3485-1 Critical: php-CAS Account Access Issue

The fix for this vulnerabilty requires an API breaking change in php-cas
and will require that software using the library be updated.

For buster, all packages in the Debian repositories which are using
php-cas have been updated, though additional manual configuration is to
be expected, as php-cas needs additional site information -- the service
base URL -- for it to function. The DLAs for the respective packages
will have additional information, as well as the package's NEWS files.

For 3rd party software using php-cas, please be note that upstream
provided following instructions how to update this software [1]:

phpCAS now requires an additional service base URL argument when constructing
the client class. It accepts any argument of:

1. A service base URL string. The service URL discovery will always use this
server name (protocol, hostname and port number) without using any external
host names.
2. An array of service base URL strings. The service URL discovery will check