some IdPs (for example OneLogin seem to exclude the trailing Z in the IssueInstant. str_to_time throws an exception in those cases.

updated the regex to handle the possible seconds in addition to the possible missing Z.  looked at the saml spec and it is unclear if the Z is required or just that the datetime is expected to be UTC.

src/saml2/time_util.py

@@ -16,7 +16,7 @@ from datetime import datetime
 
 TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
 TIME_FORMAT_WITH_FRAGMENT = re.compile(
-    "^(\d{4,4}-\d{2,2}-\d{2,2}T\d{2,2}:\d{2,2}:\d{2,2})\.\d*Z$")
+    "^(\d{4,4}-\d{2,2}-\d{2,2}T\d{2,2}:\d{2,2}:\d{2,2})(\.\d)*Z?$")
 
 # ---------------------------------------------------------------------------
 # I'm sure this is implemented somewhere else can't find it now though, so I