Initial support for WS-Trust federation endpoints

The WS-Trust federation endpoints reuse the existing token service
implementation that already supported federation for the passive
scenario. However, the new endpoints rely on a new service host factory
in order to configure a dedicated claims authentication manager that
will be responsible to introduce the claim that will signal to the token
service that this request is coming from an external identity provider.

These were the bare minimum changes to get federation working for the
active scenario. If we reach a conclusion that an approach like this one
is acceptable and correct I'm willing to spend more time into this and add
more documentation and if possible a few automated tests.

Thanks in advance for any feedback you may provide on this.