Add WS-Security support: UsernameToken, XML Signature, XML Encryption

[rubyjedi]

Summary

• Adds SOAP::WSSE::UsernameTokenFilter, SignatureFilter, and EncryptionFilter (lib/soap/wssecurity.rb), covering the WS-Security UsernameToken Profile 1.0/1.1 (plain and digested password), XML Signature (SOAP Body, exclusive C14N, RSA-SHA1), and XML Encryption (AES-128-CBC content encryption + RSA-OAEP key transport). soap4r-ng had no WS-Security support of any kind before this.
• Verified end-to-end against all 9 endpoints of a real, self-hosted Bernardo-MG/spring-ws-security-soap-example WSS4J+XWSS test server (soap4r-ws-security-testbed, sibling project) — unsecured, password (plain/digest × WSS4J/XWSS), signature (WSS4J/XWSS), and encryption (WSS4J/XWSS) — and across the full supported matrix of XML parsers × HTTP client backends.
• Formalized into a permanent e2e suite (test_ws_security_e2e/, its own rake test:ws_security_e2e task, kept outside test:deep since it needs the live test server).
• Compatibility fixes for Ruby down to 1.8.7 (keyword-argument syntax, Base64 encoding differences), found by actually running the suite against those old Rubies, not just reasoning about syntax support.
• Closes the response-side gap found while comparing against Savon/Akami's own WS-Security support: SignatureFilter#on_inbound verifies a signed response (checking every signed Reference's digest, not just the Body's — WSS4J also signs its own SignatureConfirmation token) and EncryptionFilter#on_inbound decrypts an encrypted response, resolving the EncryptedKey via KeyInfo and RSA-OAEP-unwrapping the AES key. Required reconfiguring the live bernardo-mg test server to actually secure its responses (it previously only validated requests).
• Found and fixed a real bug along the way: WSS4J/XWSS pad AES-CBC content per XML-Enc's own padding rule (only the last byte is meaningful), not PKCS7 — OpenSSL's automatic unpadding enforces PKCS7 and rejected valid plaintext as "bad decrypt" until switched to manual unpadding.
• Added a tamper-detection test (wrong cert → VerificationError) alongside the positive-path tests, which now exercise both directions since on_inbound runs automatically.

Test plan

• All 10 test:ws_security_e2e tests pass against the live Bernardo-MG server (WSS4J + XWSS, all 9 endpoints, plus a tamper-detection negative test).
• Full test:deep suite (345 tests) passes.
• Verified this branch merges cleanly against master both as-is and after Add pluggable curb/Faraday HTTP client backends #33 (curb/faraday) lands, via git merge-tree trial merges — no conflicts either way.
• GitHub Actions CI run on this PR (will run automatically once opened).

[rubyjedi]

This PR's changes were merged into master as commit 172cc37 (rebased onto master after PR #33 landed, then fast-forward pushed). GitHub closed this PR without marking it merged due to a push-ordering quirk — the branch update caught up to master after the content already landed, leaving a zero-diff PR that GitHub silently closed instead of recognizing as merged. Confirmed 172cc371 is an ancestor of master; no content was lost.