fix(sdk): harden spec conformance across core, agent, service, and pl…

[zhoodar]

Spec conformance hardening

Verifies every module against the aep-spec drafts and fixes what they
turned up. Where the Node SDK and the drafts disagreed, the drafts decided;
on several points Node and Java already agreed and this SDK was the outlier.

Headline fixes

• platform — create_did_document copied the key store's JWK verbatim
  into a document served to anyone resolving the Agent DID, so one still
  carrying d published the signing key (PLT-DID-002). lifetime_seconds
  above the configured maximum raised before authorization, so any caller
  could reach it (PLT-SIGN-011).
• core — urlsplit strips CR/LF/tab before parsing, so a did:web host
  was validated sanitized and used raw, putting a carriage return in a URL
  handed to an HTTP client; render_authorization emitted CR and LF
  verbatim; OpenAPI security inheritance (CORE-OAS-011/013/014/015) had no
  implementation at all.
• service — a malformed AEP presentation answered
  authentication_required instead of not_recognized (CORE-PR-038);
  Basic credentials were issued that cannot survive RFC 7617 encoding
  (BSC-RSP-003).
• adapters — HEAD was unsupported where GET was, and unsupported
  methods answered 400 while already sending Allow (RFC 9110 9.1, 15.5.5).

The agent package needed no fixes.

The conformance harness could not fail. Nine agent mappings compared
two constants or two fields of the same vector; one asserted a hard-coded
set literal. They now drive the real Agent, Platform and Service.
tests/test_conformance_falsifiability.py feeds each vector twice — once
published, once with a corrupted expectation — and requires the result to
flip; it caught three mappings written for this PR.

Verification — make verify green; 293 tests;