storage/kubernetes: fix conflict error detection in TRP creation

PR #815 fixed the Kubernetes storage implementation by correctly
returning storage.ErrAlreadyExists on POST conflicts. This caused a
regression in TPR creation (#822) when some, but not all, of the
resources already existed. E.g. for users upgrading from old
versions of dex.

Fixes #822

storage/kubernetes: fix hash initialization bug

storage/kubernetes: fix kubernetes storage conformance test failures

simplified clone: using go get

storage: Surface "already exists" errors.

web/static/main.css: fix typo.

api: adding a gRPC call for revoking refresh tokens.

api: adding a gRPC call for listing refresh tokens.

storage: Add OfflineSession object to backend storage.

server: clean up test comments and code flow

Documentation: warn admins not to edit dex ThirdPartyResources manually

Fixes #706

{web,server}: use html/template and reduce use of auth request ID

Switch from using "text/template" to "html/template", which provides
basic XSS preventions. We haven't identified any particular place
where unsanitized user data is rendered to the frontend. This is
just a preventative step.

At the same time, make more templates take pure URL instead of
forming an URL themselves using an "authReqID" argument. This will
help us stop using the auth req ID in certain places, preventing
garbage collection from killing login flows that wait too long at
the login screen.

Also increase the login session window (time between initial
redirect and the user logging in) from 30 minutes to 24 hours,
and display a more helpful error message when the session expires.

How to test:

1. Spin up dex and example with examples/config-dev.yaml.
2. Login through both the password prompt and the direct redirect.
3. Edit examples/config-dev.yaml removing the "connectors" section.
4. Ensure you can still login with a password.

(email/password is "admin@example.com" and "password")

Documentation: Minor changes to SAML connector doc.

Improve SAML Signature and Response Validation

connector: add GitLab connecor

server: support POSTing to authorization endpoint

Fixes #791

Documentation/proposals: Add a proposal for refresh token revocation.

* Improve Order of Namespace Declarations and Attributes in Canonical XML. This is related to an issue in goxmldsig for which I created an [pull request](https://github.com/russellhaering/goxmldsig/pull/17).
* Do not compress the AuthnRequest if `HTTP-POST` binding is used.
* SAML Response is valid if the Message and/or the Assertion is signed.
* Add `AssertionConsumerServiceURL` to `AuthnRequest`
* Validate Status on the Response
* Validate Conditions on the Assertion
* Validation SubjectConfirmation on the Subject

cmd/dex: make connector name field mandatory in dex configuration.

Docs: Added a name to the LDAP connector