SP metadata: distinguish signing and encryption certs

[benjamine]

(see #150)
this PR attempts to make SP metadata distinguish between signing and encryption certs (they can be the same, or they can be different, or only of them can be specific).

here's an example with both being specified:

    <md:KeyDescriptor use="signing">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1NbLn2Ao3cyAZ7SyfXif0gfctUML2Vjo9bovTyKF1Z/Ox9qj0lvqxIrKWJ3kPxSy2RXGFQvo7z/odPGMYkYQSQUdFEjVCBKzlT5DKu41NZaqHA9rHPHpLFMzqRkzCVFMPhvoZiVv9MyJ/3O3ZSFgGIjhQi8uxMRruNlwZ1HK5u10ALxEAyBJuhrUnXR6qeiKFYwmJfB5cu/svao5z7CWr2vQ8t9OiTywTz2cyIvzgNMtiqlc6017gy5zDWYyPoVGR6Gb+DyCmCq81VlHgmoDyaVpsPDKFFi4exJ/TiSeFVm/oXLl4Z5AkBdIA8z56T74xqOJjH5+L/ukbY8nZ6NrXQIDAQAB</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>MIIBIjCXBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1NbLn2Ao3cyAZ7SyfXif0gfctUML2Vjo9bovTyKF1Z/Ox9qj0lvqxIrKWJ3kPxSy9RXGFQvo7z/odPGsYkYQSQUdFEjVCBKzlT5DKu41NZaqHA9rHPHpLFMzqRkzCVFMPhvoZiVv9MyJ/3O3ZSFgGIjhQi8uvMRruNlwZ1HK5u10ALxEAyBJuhrUnXR6qeiKFYwmJfB5cu/svao5z7CWr2vQ8t9OiTywTz2cyIvzgNMtiqlc6017gy5zDWYyPoVGR6Gb+DyCmCq81VlHgmoDyaVpsPDKFFi4exJ/TiSeFVm/oXLl4Z5AkBdIA8z56T74xqOJjH5+L/ukbY8nZ6NrXQIDAQAB</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>

(pending tests, and refs to SAML specs, but submitting to start getting feedback on the PR)

[benjamine]

I'm realizing this is a very edgy case (using a single cert, for any of both usages, seems fine), at least for our needs.
I'll close this one for now.