[security-services] Third draft of Signature document

Here's another, fairly extensive, revision. An additional section
discussing SAML profiles (specifically Browser/POST) outlines a best
practice for that specific case, and only uses mandatory parts of the
XMLSig spec.

I did not try and capture every single possible Signature syntax option
I was given, but I tried to incorporate the most useful advice I could
extract from the responses.

I may be able to make at least part of the call (I'm in LA at a
meeting), so I'd suggest if I'm not there at noon, holding discussion
until 12:15 or so in case I'm just late, and then proceeding as you see
fit.

-- Scott