feat(openid4vc): add mso_mdoc CBOR parser for credential metadata extraction

This issue tracks the Phase 1 parser work: adding CBOR parsing capability so mdoc metadata can be read from the raw `IssuerSigned` structure returned by the issuer.

This is a prerequisite for:
- Correctly populating `CredentialFormat::Mdoc` fields on storage (tracked separately)
- Minimum serde structs to represent `IssuerSigned`, `COSE_Sign1`, `MobileSecurityObject`, and `ValidityInfo` from ISO 18013-5
- base64url-decodes the raw credential string
- CBOR-decodes it as `IssuerSigned`
- Extracts the MSO payload from `issuerAuth` (COSE_Sign1 element `[2]`)
- CBOR-decodes the MSO payload
- Returns `doctype`, `issued_at` (from `validityInfo.signed`), and `valid_until` (from `validityInfo.validUntil`)
- A typed `MdocParseError` covering decode and missing field failures
- Export `mdoc` module from `credential/mod.rs`

## Acceptance Criteria

- `extract_mdoc_metadata` correctly extracts `doctype`, `issued_at`, and `valid_until` from a valid base64url-encoded `IssuerSigned` CBOR blob.
- Invalid base64url input returns a typed error, not a panic.
- Invalid or malformed CBOR returns a typed error, not a panic.
- Missing `validUntil` in `validityInfo` is handled gracefully as `None`.
- Unit tests cover: valid mdoc input, invalid base64, invalid CBOR, missing `validUntil`.
- No existing tests are broken.
- No changes to `store_credential`, `store_credentials`, or any existing issuance flow this PR is a standalone parser module only.

est time: 1 day