[thomasnymand]

Fixes from running NemLog-in's integration test cases against 3.1.0 in DevTest4.

Audit log

• The entry for an AuthnRequest identifies it (ID, IssueInstant, Issuer) instead of holding its XML, as the release notes say. The XML is traced at Verbose.
• A response refused at the assertion consumer service is audited as "Response refused: …".
• A login request refused for its level of assurance or profile is audited as "Login refused: …".
• An outgoing LogoutResponse is audited with its binding and status.

HTTP status

• A response refused at the assertion consumer service answers 400 instead of 500, including one that can't be read or arrives without a session. A fault in the service provider stays 500, and configuration errors outside this path are unchanged.
• The artifact binding isn't changed.

Docs

• The readme and release notes state the encryption the library accepts: AES-CBC with RSA-OAEP. The SP metadata lists these, and they must be kept when registering it.
• The readme states that MaximumSessionLength is checked with the allowed clock skew.

Tested: 356 unit tests, and the affected cases against DevTest4 with WebsiteDemo: IT-LOG-1, IT-REPL-1, IT-SLO-2 and a refused level of assurance. IT-FORCE-1 was also run.