feat!: add first-class NameIDFormat support

[william-suppo]

Summary

• Expose NameIDFormat across the high-level API: IdP/SP metadata (nameIdFormats), AuthnRequest's NameIDPolicy (nameIdPolicyFormat), AuthnResponse, and LogoutRequest (send + receive)
• Introduce Litesaml\Models\Messages\NameId (value + format) to replace the separate nameId/nameIdFormat properties, avoiding orphaned/inconsistent pairs

Breaking change

nameId is now a NameId value object instead of a plain string on AuthnResponse, LogoutRequest, and as the sendLogoutRequest() parameter:

// before
$message->nameId; // string
$sp->sendLogoutRequest($idp, 'user@example.com');

// after
$message->nameId?->value;
$message->nameId?->format;
$sp->sendLogoutRequest($idp, new NameId('user@example.com', $format));

Closes #7

Test plan

• composer test (72/72, one pre-existing unrelated failure on master: handle_authn_response_rejects_xml_signature_wrapping_attack)
• composer phpstan clean