be more explicit about locating references
be more explicit about locating references

I've been unable to exploit this as is, but the theory is if you
can stuff another Reference in that xmlsec ignores, but we see,
we'll trust the wrong node. if we ever expand reference checking
to look for all references instead of the first (like we
technically should), then we would be vulnerable because a bogus
reference could be stuff in later under an Object.

strydercorp/ruby-saml,instructure/ruby-saml