Support signing SAML requests

This issue has been migrated from [#11130](https://github.com/matrix-org/synapse/issues/11130).

---

Currently it is not possible to use SAML SSO with an IdP that requires signed requests.

However, the change is trivial:

```patch
--- saml.py.old 2021-10-19 13:47:01.000000000 +0200
+++ saml.py 2021-10-20 08:42:26.897442375 +0200
@@ -112,7 +112,8 @@
client_redirect_url = b"unused"

reqid, info = self._saml_client.prepare_for_authenticate(
- entityid=self._saml_idp_entityid, relay_state=client_redirect_url
+ entityid=self._saml_idp_entityid, relay_state=client_redirect_url,
+ sign=True
)

# Since SAML sessions timeout it is useful to log when they were created.
```

This True value should probably come from the config.

Start in saml.py at the _saml_client.prepare_for_authenticate call shown in the issue, then trace how SAML settings are loaded. Make request signing configurable rather than always enabled, and verify that an IdP requiring signed requests can complete SAML SSO without breaking the existing flow.

Written by the indexing model from the issue text.