Adds support for separate auth/enc keys

- If privateCert and publicCert are defined, then publish the publicCert
  in the metadata as KeyDescriptor with use = "sign" and the decryptCert
  as KeyDescriptor with use = "encryption"
- If privateCert and publicCert are not defined and decryptCert,
  decryptPvk are defined, then publish decryptCert in the metadata as
  KeyDiscriptor with no use attribute
- If no certificates are defined, then skip KeyDescriptor altogther

Example configuration:

```
"passport": {
  "saml": {
    "decryptionCertName": "ssl/saml-encrypt.crt",
    "decryptionPvkName": "ssl/saml-encrypt.key",
    "publicCertName": "ssl/saml-sign.crt",
    "privateCertName": "ssl/saml-sign.key"
  }
}
```