Proposal on config for includeAttributeStatement

[Cantor, Scott]

In addition to actually honoring that flag, which we're not doing yet, I
need to address the larger bug in IDP-80, which is an old issue with V2
that can cause up to three separate attribute resolutions in a single SSO
transaction.

The suggestion by Rod in that bug to make the include flag multi-state has
a limitation, which is that it doesn't cover the scenario in which you
need to resolve attributes in order to produce a NameID, which is
generally the case unless transients or database-backed persistents are
used.

I'm also uncomfortable making it the default to only resolve attributes
when includeAttributeStatement is true, because that won't really be
backward compatible (unless we knew apriori that only transient IDs were
in use).

My imperfect suggestion is to add a second SSO profile flag as an
overarching "resolveAttributes" setting that defaults to true.

That allows the following decision tree:

1. resolveAttributes is false:
	- don't resolve attributes
	(by implication nothing being included in the SSO assertion)

2. resolveAttributes is true:
	a. The artifact profile/binding is used outbound
	- resolve attributes and include them in the assertion
	(effectively override includeAttributeStatement to be true at runtime)

	b. includeAttributeStatement is true:
	- resolve attributes and include them in the assertion

	c. includeAttributeStatement is false
	- resolve attributes but don't include an AttributeStatement

That's about the best I can come up with.

-- Scott