feat(jans-fido2): reject REVOKED/compromised MDS authenticators at registration (enforced mode)

**Is your feature request related to a problem? Please describe.**
The FIDO Alliance conformance suite registers an authenticator whose MDS
statusReport is REVOKED and expects the server to reject it (part of #9640).
In jans-fido2, `verifyStatusAcceptable` already treats REVOKED (and the other
compromise statuses) as unacceptable and drops the entry from the MDS TOC, but
the named REVOKED status is not explicitly covered by a test, so the conformance
guarantee is not locked.

**Describe the solution you'd like**
Ensure a REVOKED MDS status results in the authenticator being rejected at
registration in enforced mode, and add explicit test coverage for the REVOKED
status (today only USER_VERIFICATION_BYPASS is tested). End-to-end this is
achieved by the existing status blocklist (REVOKED dropped from the TOC) plus
the enforced-mode metadata-fetch rejection (CONF-22).

**Describe alternatives you've considered**
Keeping REVOKED entries in the TOC and rejecting explicitly at registration —
rejected because it changes TOC contents and would alter `monitor`-mode
behavior, adding regression risk for marginal benefit over the existing
drop-from-TOC + enforced-reject path.

**Additional context**
Part of the FIDO2 Server Functional Conformance remediation tracked in #9640
(Phase 5). Builds on CONF-22 (enforced metadata-fetch rejection). Because this
affects MDS trust decisions, final validation needs the FIDO conformance tool +
a test MDS deployment. Component: jans-fido2.