Add possibility to check the SAML signing cert's fingerprint

• this introduces another layer of security, especially for when the signing key is fetched from a URL
• adapted from the suggestion made by Peter Brand
• abort if the fingerprint is defined and doesn't match the calculated value
• complain if no fingerprint is specified and the certificate is fetched from a URL (but keep quiet if it's a local file)

config/saml2-backend.yaml

@@ -4,7 +4,8 @@
 #
 # more information:
 # https://wiki.oasis-open.org/security/FrontPage
-# https://github.com/IdentityPython/pysaml2/blob/master/docs/howto/config.rst
+# https://github.com/IdentityPython/pysaml2
+# https://pysaml2.readthedocs.io/en/latest/howto/config.html
 #
 module: "satosa.backends.saml2.SAMLBackend"
 name: "saml"