queryAssertion: allow whole response to be signed

Some providers sign the whole response, not just the "Assertion"
element. This change makes the xpaths to find the signature and the
assertion a little more flexible.

Note: The validity of the document is determined elsewhere, this code
mainly tries to find the assertion that *was* signed.