InResponseTo SubjectConfirmation validation support

This PR is for support for validation the InResponseTo attribute and limited support for the SubjectConfirmation element of a SAML response.

* The `Id` attribute of generated SAML requests are cached in the module when support for the InResponseTo validation is turned on
* This cache of ids is set to expire (default is 8 hours)
* When processing a SAML response, the handler code will now:
 * Look for the `InResponseTo` in the root `Response` element and validate that it has been seen before (hit in the cache)
 * Look for the `InResponseTo` attribute in the `SubjectConfirmationData` element if supplied.  This value must match the top level id and hit the cache as well
 * Remove the id from the cache if a response with a matching id has been processed
* Validation for `InResponseTo` is by default false, perhaps it is better to be more restrictive, although this could break existing clients