fix(sdk): harden spec conformance across core, agent, service, and pl…

[zhoodar]

Spec conformance hardening

Verifies every published module against the aep-spec drafts, fixes the
non-conformance and the defects found along the way, and raises coverage
from 87 tests to 493. Where the Node SDK and the drafts disagreed, the
drafts decided.

Headline fixes

• core — AepOpenApi.resolveSecurity did not exist, so OpenAPI security
  inheritance (CORE-OAS-011/013/014/015) was unimplemented.
• service — a credential offered in Authorization rather than
  AEP-Authorization was never found (OAB-PRS-003, BSC-PRS-003); a malformed
  AEP presentation answered authentication_required instead of
  not_recognized (CORE-PR-038); HEAD was unsupported where GET was.
• platform — signing and new verification accepted a non-ACTIVE identity
  (PLT-LIFE-002, PLT-SIGN-007, PLT-VER-004); the minted assertion's kid was
  not bound to the issuer (PLT-SIGN-022).
• agent — Inspect caching ignored no-store, the default freshness
  lifetime and the post-redirect cache key; redirects forwarded an assertion
  bound to the origin request.

The conformance harness could not fail. Several mappings returned true
regardless of SDK behaviour, comparing two constants or two fields of the same
vector; some asserted the opposite of what their vector is named for.
ConformanceFalsifiabilityTest now runs each mapping against the published
vector and against a corrupted expectation and requires the result to flip — it
caught three of the replacements written for this PR.

./mvnw verify green on all 13 modules; every applicable vector passes through
the conformance adapter for agent, platform and service.