feat(jans-auth-server): agent identity via JWT-SVID

### Description

feat(jans-auth-server): agent identity via JWT-SVID

An operator enrolls an AI agent with jans-auth-server. The agent generates a keypair inside a
hardware secure element (TEE / TPM / enclave) — the private key never leaves it. jans-auth-server
binds that key to the agent's registration, and from then on mints short-lived **JWT-SVIDs** for
it: standard SPIFFE tokens whose `sub` is the agent's SPIFFE ID and whose `cnf` claim pins the
token to the enclave key. jans-auth-server publishes its signing keys as a **SPIFFE trust
bundle**, so any relying party — including federated SPIRE deployments — can verify the token
offline. Presenting the token *plus a proof signed by the bound key* proves not just "jans vouched
for this identity" but "the caller, right now, holds the hardware-sealed key that identity was
issued to."

Design Plan
https://github.com/JanssenProject/jans/blob/jans-auth-server-14988/docs/janssen-server/auth-server/oauth-features/agent-identity-jwt-svid.md

### Test cases and code coverage

- [ ] Write unit test to cover added/changed code
- [ ] Update integration tests to cover added/changed code
- [ ] Documentation