Make name resolution configurable in OpenSamlLogoutRequestValidator

Describe the bug
Spring SAML considers NameID to hold username, populates Saml2AuthenticatedPrincipal#name with NameID value and later in Single Logout flow again populates/validates NameID value using Principal Name. This behaviour breaks our current integrations.

Username can be released by IdP in one of Assertion’s Attribute element instead. NameID, if present (as it is even optional, as also discussed in https://github.com/spring-projects/spring-security/issues/11463), can be of different Format, holding different kind of values.

One example for all: According to SAML spec, NameID Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient indicates that the content of the element is an identifier with transient semantics and SHOULD be treated as an opaque and temporary value by the relying party. This NameID element is also sent by IdP in LogoutRequest (causing validation against Principal Name in OpenSamlLogoutRequestValidator#validateNameId to fail) and is expected to be present in LogoutRequest sent from relying party (where it is populated with Principal Name in OpenSamlLogoutRequestResolver, making the IdP refuse the request).

Our workarounds:

1. Login: Custom responseAuthenticationConverter to retrieve username from Attribute + storing NameID element for later use.
2. Outbound LogoutRequest: Overriding NameID element with correct one stored during login.
3. Inbound LogoutRequest: There is no easy or clean way to work around this, because OpenSamlLogoutRequestValidator is not much configurable.

To Reproduce
Reproduced when integrating with Shibboleth IdP, which uses transient NameID and an Attribute to release username.

Expected behavior
Whole NameID element could be stored in DefaultSaml2AuthenticatedPrincipal (similar as session indexes are stored already) during login. It would be used to construct NameID element in outbound LogoutRequest, and it’s value would be used for validation when handling inbound LogoutRequest.

Ideally could you consider also to configure where to retrieve the username from in the first place (NameID element versus providing a Name of an Assertion Attribute)?