Validate HMAC-signed ID tokens in the client filter

I am trying to integrate the client filter into an application using [Auth0](https://auth0.com/) as an OP. After coding around some minor spec compliance issues (which I have reported to them), I'm now working on ID token validation. The only signing algorithm they seem to support is HS256.

Adding support for HMAC validation was fairly straight-forward now with the presence of `SymmetricCacheService`. However, that class has somewhat-surprising behavior: it assumes that client secrets (as represented in `ClientDetailsEntity`) are not Base64 encoded. It seems like `ClientDetailsEntity` needs some way to indicate that the secret is already encoded.