Implement machinery for session key generation

The updated ECP profile includes support for generating a session key for the client and server. This will have to be captured in both the assertion and an outbound SOAP header, so needs to involve a profile action.

There are also encryption implications to this.