Fix validUntil timezone issues

Several things, hopefully not all botched:

* Partial writeup cf. https://groups.google.com/forum/#!topic/simplesamlphp/7m07m9gLzzA
* Use `utcnow()` instead of `now()` to keep everything in UTC.
* Only calculate `now` once and reuse.
* Force `validUntil` to a string, otherwise the `len() > 0` check fails.
  (For some reason `req.args.get()` returns a datetime.datetime object from the feed config when `validUntil` is an iso8601 string there, and string when it's an XSD duration.)
* `dt.isoformat()` generates strings with no timezone indicators, like Z (no matter the local tz info). Also it generates 6 digits of fractional seconds (unnecessary precision, esp when combining with an unspecified timezone). Replaced with manually formatting via strftime, also hardcoding Zulu time(zone).
* According to the docs `validUntil` can also be an "absolute ISO 8601 time string" (which failed the `len()` test mentioned above) but in that case no `validUntil` got generated in the XML, which this also adds.
* Finally, `iso8601.parse_date()` returns a "timezone aware" object from which `now` ("naive") cannot be substracted, so make dt "naive"