Put <ds:Signature> as the first child for enveloped signature.

The current code has two issues:

(1) It add sig to the signed element's Child, but does NOT update the index and parent. It should call "Element.AddChild(t)" 

(2) the <ds:Signature> is added as the last child. But based on SAML standard, this should be the first child.

Both of these issues will be solved by this update.

sign.go

@@ -297,7 +297,7 @@ func (ctx *SigningContext) SignEnveloped(el *etree.Element) (*etree.Element, err
 	}
 
 	ret := el.Copy()
-	ret.Child = append(ret.Child, sig)
+	ret.InsertChildAt(0, sig)
 
 	return ret, nil
 }