Set AllowCreate default value to true

[remilapeyre]

The SAML2Core spec says for AllowCreate:

A Boolean value used to indicate whether the requester grants to the identity provider, in the
course of fulfilling the request, permission to create a new identifier or to associate an existing
identifier representing the principal with the relying party. Defaults to "false"if not present or the entire
element is omitted.

[...]

Requesters that do not make specific use of this attribute SHOULD generally set it to “true” to
maximize interoperability.

[hcjulz]

@remilapeyre thx for the PR.
In general this looks good to me, but I went through the specs again: OASISCoreSpec and SAML2Int.

In SAML2Int they say:

[SDP-SP04]
The <samlp:AuthnRequest> message MUST either omit the <samlp:NameIDPolicy> element (RECOMMENDED), or the element MUST contain an AllowCreate attribute of "true" and MUST NOT contain a Format attribute.

In OASIDCore they say about the NameIDPolicy element:

[3.4.1 Element <AuthnRequest>]
... If omitted, then any type of identifier supported by the identity provider for the requested subject can be used, constrained by any relevant deployment-specific policies, with respect to privacy, for example.

Then on the AllowCreate option they say it should generally be set to true if a NameIDPolicy element is set.

So this means, if no NameIDFormat element is set, the requester can use any supported identifier supported by the IDP. Which is why SAML2Int recommends this setting. Because of that I'd suggest we default to false and no NameIDPolicy element (as recommended). Does that make sense?

[hcjulz]

Given this is a flag, we might come around it without a bool param. Something linke DisableAllowCreate().