Authn refactoring

[Cantor, Scott]

I've started some refactoring of the Authn and Session code to reflect some of the design I posted in the wiki. I just checked in a first round that's mostly adding some packages and a new SubjectContext type.

Next steps:

- continue working on what should be in each context type and the AuthenticationEvent and Workflow classes
- avoid keeping logic and helper functions into the contexts themselves, I think those should be for holding state only
- decouple authn code from interacting with the Session context/objects, as this has been a sore spot with V2
- de-Springify existing Actions and get them in shape to match design changes we've made

Long term, it's conceivable that they could be OpenSAML actions and a lot of this code could be moved. But I'm not sure that's sensible or useful. I think authentication is probably a reasonable thing to demarcate OpenSAML from actual IdP code.

I will probably be encroaching into the subject name canonicalization area at some point and will coordinate on that if I do.

-- Scott