Add DoS mitigation option to ACS/SLS endpoints

Problem/Motivation

Calculating/verifying signatures is computationally expensive.

As security issues are reported at an ever increasing pace this year, there's a heightened risk of finding bugs that enable CPU-related DoS attacks.

Steps to reproduce

None. (Yet? / Depending on the installed version of upstream modules.)

Proposed resolution

For our endpoints which process XML messages sent from the IdP: implement an option to discard long messages before processing. This can be set by admins when they're under (perceived / suspected future) attack.

Document that this is meant as a temporary workaround: as a permanent measure, it's better to configure this limit in the webserver.

For login/logout routes: #3211536: Reimplement response caching on login/logout routes