handle multiple attribute values with the same name instead of concatenating them

[fumieval]

Summary

For example, this allows having multiple role attributes assigned to one user. (Otherwise role names are literally concatenated, which is a rather surprising behaviour)

Checklist

• All definitions are documented with Haddock-style comments.
• All exported definitions have @since annotations.
• Code is formatted in line with the existing code.
• The changelog has been updated.

[mbg]

This looks like a sensible change given that the spec notes that multiple AttributeValue elements are allowed.

Just one minor suggestion for improving one of the docs comments. Otherwise this looks good to me, thank you!