fix(slo): validate Destination at typed receivers

[salasebas]

Summary

• enforce binding-aware Destination validation in typed receive_slo and finish_slo flows for both SP and IdP roles
• cover HTTP-POST, HTTP-Redirect, and HTTP-POST-SimpleSign using the local SLO endpoint selected for the binding
• reject a present mismatch, and reject a missing Destination once the binding or root XML signature authenticates the message
• perform the check before replay storage while preserving the existing raw parser behavior
• document raw FlowResult as context-limited and caller-owned for actual-endpoint comparison

Why

The concern behind #87 is real at the typed receiver boundary, but raw/typed parity is not the right contract. The typed facade knows the local role, binding, metadata endpoint, peer, and transaction; the raw compatibility parser does not receive the actual endpoint.

Previously, typed SLO compared only a present Destination after parsing. A signed message could therefore omit the attribute and reach successful typed handling. Moving the comparison into the authenticated flow supplies the missing receiver context and guarantees rejection before replay state is written.

Standards

• SAML Core 2.0 §§3.2.1 and 3.2.2: compare a present Destination with the actual recipient
• SAML Bindings 2.0 §§3.4.5.2 and 3.5.5.2: signed Redirect/POST messages carry and verify Destination
• SAML V2.0 HTTP POST-SimpleSign CD04 §2.4
• SAML Profiles 2.0 §§4.4.3–4.4.4 for front-channel SLO authentication and integrity

Compatibility

• no public API additions or removals
• raw logout parsers keep their existing behavior
• unsigned missing Destination remains available only through explicit compatibility policy where the binding permits unsigned input

Validation

• cargo fmt --all --check
• cargo clippy -p saml-rs --all-targets -- -D warnings
• cargo nextest run -p saml-rs — 753 passed
• cargo test -p saml-rs --doc
• RUSTDOCFLAGS="-D warnings -D missing_docs" cargo doc -p saml-rs --lib --all-features --no-deps
• cargo test -p saml-rs --doc --no-default-features
• cargo check -p saml-rs --no-default-features
• independent Standards and Spec review — no remaining findings