Add per-client signing key for WS-Fed clients

[AlistairDoswald]

Currently, the WS-Fed module uses the realm key for Signing SAML tokens. However, in a paper that presents a proof for WS-Fed being secure, one of the requirements is that the key used to sign WS-Fed messages is not used to sign messages from other protocols. To follow this recommendation, we should add an option to use a key specifically used by the client.

When the option is activated, it should generate a private-public key pair for the client (as in the SAML client), but keep the private key inaccessible (as for the realm key). It should have the option to regenerate a new private-public key pair, and to import a private-public key pair. Deactivating the option must not erase the key, just revert to using the realm key.