Create a SAML 2 profile workflow action that decrypts incoming Subject name identifier

Established default location as SecurityParametersContext child of inbound MessageContext.

We could put this below RelyingPartyContext via injected function, but I'm inclined to leave it, because the SAML 2 use cases we have today are protocol message field decryption, which feels like inbound context. We could make it a handler, but leaving the action gives more flexibility for other use cases.

If decryption parameters aren't set, it fails by default on finding anything to Decrypt. That seems appropriate for the use cases we have, which can't follow up if the subject is opaque.

TBD: error handling if no DecryptionParams are set, location by default of the context

Working action checked in, still unsure about specifics of decryption config usage.

Make Chad's cases unassigned