SecurityTokenReference elements in do not contain TokenType

The WSS SAML Token Profile 1.1 specifies that when a SecurityTokenReference
points to a SAML 2.0 assertion, the element MUST have a wsse11:TokenType
attribute of either
[http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0](http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0). For
SAML 1.1, the attribute is optional, but SHOULD contain
[http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1](http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1)

This is both a problem in the STS (DefaultSAMLTokenProvider) and when including
SAML tokens as primary tokens in requests.
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[current]

Source: [https://github.com/javaee/metro-wsit/issues/1324](https://github.com/javaee/metro-wsit/issues/1324)
Author: glassfishrobot

Start by locating DefaultSAMLTokenProvider and the code that includes SAML tokens as primary tokens in requests. Check how each SecurityTokenReference is built against the WSS SAML Token Profile 1.1 requirements, then verify that SAML 2.0 references require the wsse11:TokenType value and SAML 1.1 references provide the recommended value.

Written by the indexing model from the issue text.