Support signature verification on encrypted response assertions

Currently if an AuthnResponse assertion is encrypted, then no signature verification is performed. This patch checks for encrypted assertion and decrypts and verifies the signature.

Also when we have multiple certs in the metadata to check against, SecurityContext._check_signature() loops over them validating - but the crypto backend can raise SignatureError so we need to catch that and continue checking.

StatusResponse._loads() can raise other SigverErrors than just SignatureError (e.g. MissingKey if we have no metadata certs for the response issuer) - so we need to catch those too.