Related to spring-projects/spring-security#11818

The order of precedence for security.relyingparty.{id}.assertingparty.signlesignon.sign-request should be like this:

1. Use whatever the application declares sign-request to be
2. Use what comes back from the metadata-url query
3. Otherwise, default to true

But it is currently like this:

1. Use what comes back from the metadata-url query
2. Use whatever the application declares sign-request to be
3. Otherwise, default to true