SAML: clarify intended handling of responses containing multiple assertions

Hi SuperTokens team,

While reading through the SAML response handling code in supertokens-core, I noticed a few behaviors around responses that contain more than one assertion, and I would like to understand the intended design before proposing any changes.

My questions:

1. Are SAML responses containing multiple assertions a supported configuration? The SAML spec allows a response to carry multiple assertions, but many service provider implementations restrict this to exactly one. I could not find documentation or tests that make the intended behavior explicit for supertokens-core.

2. When validating audience restrictions, the current code appears to accept the response if ANY assertion's AudienceRestriction matches the expected audience, rather than requiring every assertion (or the specific assertion used to establish the session) to match. Is this the intended semantics?

3. Assertions without a Conditions element appear to skip condition validation entirely, so no NotBefore, NotOnOrAfter, or audience checks are applied to that assertion. Is accepting condition-less assertions intended, or should they be rejected?

4. When multiple assertions carry the same attribute name, claim extraction appears to be last-writer-wins, so the final assertion silently overwrites values from earlier ones. Is this the intended merge behavior, or should duplicate attributes be rejected or merged differently?

Depending on your answers, I am happy to send a PR that hardens the handling in whichever direction matches maintainer intent (for example, rejecting multi-assertion responses outright, or tightening validation per assertion), along with tests.

Thanks, Sasha