Fix LogOutRequest XML signatures

- The XMLSecurity.sign method was outputting its result with pretty
   formatting turned on. This was messing with whitespace in the result
   rendering the included digest (and therefore signature) invalid
 - When sigining the XML, optionally add a URI to the Reference which
   points to the ID of the element being signed, and use this feature in
   when signing the LogOutRequest. Shibboleth will fail to validate
   unless this URI attribute is present and properly dereferences to the
   element being signed
 - Report the NameID format properly in the LogOutRequest; it was pinned
   as 'transient' before. This preventied Shibboleth from logging a
   user out when other NameID formats were used, causing it to respond
   with status:UnknownPrincipal
 - We now include the public certificate in the body of the
   LogOutRequest. While I have yet to find an IdP that requires it, it's
   definitely more convenient and often simplifies debugging