`ProviderConfig._load_federation_metadata` loads expired certificates

[erfaan]

The ADFS Server 2012 R2 configuration looks like this:

Please note that the first certificate is active whereas the second one is expired.

The Federation metadata lists both certificates under fed:SecurityTokenServiceType.

Following code loads all certificates including the expired one.

https://github.com/snok/django-auth-adfs/blob/378f14129d774ac035804e09f7b6a1b3f5a3f71f/django_auth_adfs/config.py#L295-L304

This causes the callback to fail with "Signature verification failed" error.