Sign log out requests

Here's a diff for review.

This does both query string signing and XML document signing. PHPSimpleSAML and OpenAM both verify query string signing for HTTP-Redirect requests, but I'm not sure that other IDPs might not want XML dsig instead. Luckily both the query string signing and the xml signing are just additional parameters/elements, so it theoretically shouldn't break anyone's integration if they're noot expecting signatures (provided they're not doing anything really silly).