When a SAML Response or EncryptedAssertion carries a ds:Signature element
but the IdP metadata contains no signing certificate, the previous code
silently skipped signature validation (the guard was
`idpMetadata.getSigningCertificate() != null && sig != null`).
An attacker could forge a SAMLResponse with an arbitrary bogus signature
against a cert-less IdP and obtain a valid session — a full
unauithenticated authentication bypass.
Fix: when a signature IS present we now require a signing certificate to
be registered. If none is found we immediately reject the request with
an ACCOUNT_ERROR. The same guard is applied to the EncryptedAssertion
signature block.
f2df4d9754
