Provide a configuration option for RPs to automatically reject unsolicited assertions

[http://blog.nerdbank.net/]

The government security profile may require that RPs reject unsolicited assertions. While RPs using DNOA today can already do that, we can help mitigate DoS attacks by skipping the check_auth step if it is determined that the incoming assertion was unsolicited anyway.

[http://blog.nerdbank.net/]

Perhaps generalize this to allow RPs to filter all assertions before check_auth messages are sent, so that assertions that don't meet the RP's custom requirements don't bog down the system with outgoin check_auth messages whose result won't be used anyway.

[http://blog.nerdbank.net/]

Feature written. Tests to still write.

[http://blog.nerdbank.net/]

master 9c9792d