Initial support for WS-Trust federation endpoints

The WS-Trust federation endpoints reuse the existing token service
implementation that already supported federation for the passive
scenario. However, the new endpoints rely on a new service host factory
in order to configure a dedicated claims authentication manager that
will be responsible to introduce the claim that will signal to the token
service that this request is coming from an external identity provider