saml-rs v0.6.0

Added

• (sso) reject a later assertion that matches an outstanding logout (#168)
• (metadata) [breaking] require the metadata signature shape on signed import
• (slo) let the logout responder choose LogoutResponse status (#167)
• (conformance) keep metadata trust and replay as caller arguments (#149)
• (slo) honor Recommended rules on typed Single Logout (#146)
• (sso) follow Web Browser SSO producer rules when generating (#144)
• (sso) honor Recommended when accepting Web Browser SSO (#143)

Fixed

• (sso) [breaking] reject unrecognized assertion conditions (#173)

Other

• (migrations) record the remaining 0.6 upgrade steps (#176)
• separate guides, reference, and explanation (#174)
• Let the identity provider return an error Response with no assertions (#175)
• Enforce HTTP-Redirect signature removal and the RelayState limit (#172)
• Expose ForceAuthn, IsPassive, and Subject on a received AuthnRequest (#169)
• Allow five minutes of clock skew and keep replay until NotOnOrAfter (#166)
• (deps) bump bergshamra (#150)
• Publish recommended() and deprecate strict() (#153)
• Point policy docs at the classification records (#152)
• (api) [breaking] name the CBC signature relaxation for E93 (#148)