Casework: stop signing registry_grant_source_issuer into task assertions

[jeremi]

Follow-up to #1029.

ThunderID sets registry_grant_source_issuer from the verified iss of the exchanged assertion, through the connection mapping rendered in crates/registry-thunderid-tooling/src/render.rs, and overwrites a value the signer supplies. The value Casework signs into the task assertion (crates/registry-casework/src/task_grants.rs) is therefore never used, and suggests the signer controls it.

• Remove registry_grant_source_issuer from the task assertion payload and update its test
• Keep sourceIssuer in the status response, which BREG compares with the retained task binding
• Keep the tooling's connection mapping, which is what sets the claim