[security-services] Open issues not reflected by core-22/23

[Scott Cantor <cantor.2@osu.edu>]

My list of items left unaddressed consists of:

Status codes (none of the various proposals that have been floated were
voted on or incorporated). SOAP seems to have a schema getting some
traction now that we could copy (uses elements and is nested).

Adding Resource attribute to AttributeQuery element (this is Shib's
"context in attribute query" issue that was voted on at the FtF w/o
text, which has now been supplied).

A vote on Simon G's proposal for passing AttrAuthority locations.

Change of AttributeValue to anyType.

Adding IssueInstant to Request element (this is a new one I haven't
posted text for yet, but I believe it's necessary to plug a replay
attack problem in the event that a binding over SOAP or HTTP without SSL
is used in the future).

-- Scott