Empty session policyURI

[us3r64]

The session policyURI can be empty from GetEndpoints so NewUserTokenSignature method of SecureChannel is going to fail.

https://github.com/gopcua/opcua/blob/main/uasc/secure_channel_crypto.go#L103

Based on the OPC UA specs, the security policy for the SecureChannel should be used in that case.
(Looks like EncryptUserPassword is following this: https://github.com/gopcua/opcua/blob/main/uasc/secure_channel_crypto.go#L67)

https://reference.opcfoundation.org/Core/Part4/v104/docs/7.37

The security policy to use when encrypting or signing the UserIdentityToken when it is passed to the Server in the ActivateSession request. Clause 7.36 describes how this parameter is used. The security policy for the SecureChannel is used if this value is null or empty.

[pyrat]

This is affecting me as well. @kung-foo does this look reasonable to you?