Upgrade Apache Santuario to version 4.X.X

[luisgoncalves]

There are some changes to XmlSignatureInput types which need to be checked carefully.

[mjechow]

I started a branch for this issue: https://github.com/mjechow/xades4j/tree/mje/xmlsec

[luisgoncalves]

In TimeStampDigestInputImpl, I see you wrote:

digestInput.write(refData.getBytes());

I've checked XMLSignatureInput's getBytes and write methods, and I think we could use:

refData.write(digestInput);

It's slightly better if the XMLSignatureInput represents a Stream, as it avoids reading it into byte[]. WDYT? Can you put that up as a PR?

---

I'm now seeing that XMLSignatureInput actually handles canonicalization, so the code in TimeStampDigestInputImpl is a bit redundant. Anyway, since it is there, we know that in the end refData always contains bytes or a stream, so calling write won't canonicalize again. That code can later get a clean up, but it requires limiting a bit what C14N algorithms can be configured in xades4j via SignatureAlgorithms, which would be a breaking change.

[mjechow]

yes, of course. I forgot that change.