Shared authorization claims: add refusal tests and tighten the claims API

[jeremi]

Follow-up to #1029.

Refusal paths in registry-platform-oidc (authorization_claims.rs) and registry-platform-audit (authorization.rs) that have no test:

• Empty or non-string values for each registry_grant_* string claim and for registry_purpose
• Over-long values and values with control characters
• Non-string registry_actor_kind
• Missing registry_purpose while the rest of the core grant set is present
• verify_context returning GrantContextError::MissingVerifiedClient and GrantContextError::InvalidVerifiedClient
• The audit event refusing with AuthorizationAuditError::InvalidActorKind and AuthorizationAuditError::InvalidCode

API tidy-ups:

• grant_claims and actor_kind take &Claims. Take &VerifiedToken instead, so unverified claims cannot reach them.
• Bound the digit length accepted by valid_key_version.
• Document that verify_context binds the client and the resource only, and that each product binds the source issuer itself. Task grants: remove the registry_grant_authority claim #1039 removes registry_grant_authority, so land it first and do not document or test the authority claim.