Identity: Move actor JWT/cert minting into the main API - #1315

…der (agent-substrate#1834)

Part of agent-substrate#1756.

- Adds `--actor-jwt-issuer`. Unset, it defaults to
`https://idp.<namespace>.svc`, the Service ate-idp-server will serve
discovery from. Before this, `iss` was hardcoded to
`https://api.ate-system.svc`, which points at ateapi's gRPC port.
- Adds `oidcdiscovery.ParseIssuer`, which requires a canonical https URL
with no query, fragment, or user info and strips trailing slashes.
ate-idp-server will use it too, so both emit the same bytes.
- Actor JWT headers now include `typ: JWT`.
- Drops the `actorIdentityJWTIssuer` plumbing into `RPCService`, unused
since agent-substrate#1315.

The default `iss` changes, but `MintActorJWT` has no production caller
yet.

Testing: new unit tests for the parser, the default, the header, and
flag resolution. `TestMintActorJWT_Success` now checks `typ`, `iss`, and
`sub`. It needs Docker, so it hasn't run locally.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR (docs
land later in the agent-substrate#1756 series)

…entity docs (agent-substrate#2597)

Part of agent-substrate#1756.

**Why:** every install still has to set `actorIdentityJWTProvider`, and
`docs/authentication.md` says it decides who may mint actor JWTs. It no
longer decides anything:

- agent-substrate#757 added it when minting lived in a separate `ActorIdentity`
service. `MintJWT` refused any caller whose JWT came from a different
provider's issuer, which in practice limited minting to atelet's
Kubernetes service account tokens.
- agent-substrate#1315 moved minting into `ateapi.Control` and dropped that check,
leaving caller limits to the authz framework.
- agent-substrate#1834 removed the last code that read the provider's issuer.

So ate-api-server requires a field and fails to start if it names a
missing provider, yet nothing uses it, and the docs say it decides who
may mint, which authorization now decides. Section 7 of
`docs/api-guide.md` still describes the old service and its atelet-only
rules.

**What changes:**

- `actorIdentityJWTProvider` is gone from ate-api-server's
authentication config, and ate-setup stops writing it.
- `docs/authentication.md` drops it and keeps the pointer to
`authorization.md` for what a caller may do.
- Section 7 of `docs/api-guide.md` now describes `MintActorJwt` and
`MintActorCertificate` on `ateapi.Control`, who may call them, their
fields, and the JWT's claims, instead of the old service, its caller
checks, and a wrong SPIFFE path. The ADK paragraph, which pointed at the
same service, now describes the egress gateway attaching actor JWTs.

For reviewers: the config is parsed strictly and ate-setup only creates
`ate-api-authentication` when it's missing, so an existing install must
delete the `actorIdentityJWTProvider` line from that ConfigMap before
ate-api-server restarts on this version.

Testing: unit tests for the config loader and ate-setup's rendered
config. I didn't run e2e; CI's e2e installs a fresh kind cluster, so it
doesn't exercise the upgrade case.

- [ ] Tests pass
- [x] Appropriate changes to documentation are included in the PR