Add rollover metadata containing all available keys

[tvdijen]

We sign our AuthnRequests to our IdPs, so we need to have metadata containing both the current and the rollover-certificate.
With this patch, the default metadata (keyslug=default or no keyslug) will contain all the configured keys.

[cdbesten]

Dit lijkt me zeer gewenst. Wij moeten volgend jaar op productie ook rollover'en en alles wat dit proces soepeler kan laten verlopen is mooi meegenomen.

[johanib]

@kayjoosten Can you:

• Add .feature test
• Check test coverage (unit needed/possible)
• Review implementation
• Assume current implementation is correct

[kayjoosten]

Request: GET /authentication/sp/metadata
GET /authentication/sp/metadata/key:rollover

1. Controller (MetadataController) receives the request, extracts the keyId (defaults to default if none given), calls MetadataProvider::metadataForSp($keyId)
2. MetadataProvider builds the SP entity object (which, after this PR, includes all keys in its KeyDescriptor list when using the default endpoint), then passes to MetadataRenderer::fromServiceProviderEntity($sp, $keyId)
3. MetadataRenderer does two things:
   • Renders the Twig XML template → the md:KeyDescriptor elements in the output
   • Calls DocumentSigner->sign($xml, $signingKeyPair) where the signing key pair is built

So when you request key:rollover, the document is signed with the rollover private key. When you request the default, it's signed with the default private key.