protect against XML envelope attacks

after verifying signatures, we build a list of "trusted roots" by walking
up to the elements referenced by the xml signatures. then we only query
against those trusted roots for details of the assertion.
gem tasks for easier releasing
guard against duplicate id XML signature envelope attacks

because we have to use xmlSecAddIDs to get xmlsec to be able to
dereference signature references in SAML responses, a specially crafted
document with duplicate IDs can fool xmlsec into validating a signature
outside of the ancestry of the reference. this provides an attack vector
for injecting an unsigned assertion.

the solution is to catch the error thrown when xmlsec sees the duplicate
ID and immediately treat the response as invalid when this occurs.
bump version to 0.1.28