Add PSAT authentication in event-ledger for NVCA otel collector

Description

NVCA's otel collector authenticates with a Kubernetes projected service-account token (PSAT), not an OpenBao-issued JWT. event-ledger cannot verify a PSAT today; it only verifies OpenBao-issued JWTs locally.

Definition of Done

• event-ledger tries local OpenBao JWT verification first. Only when that fails does it fall back to SIS token introspection (POST /v1/nvca/tokens/introspect) for NVCA's PSAT, the same ordered chain ReVal uses. The unverified aud claim is never used to route or authorize the request.
• A successful introspection result requires the expected NVCA subject and a non-empty cluster identifier before the caller is treated as authorized, and that identity is only honored on Event Ledger's write endpoints.
• The SIS-verified cluster identifier is authoritative over anything a request payload claims: a mismatch is rejected and a missing value is filled in before the event is stored.
• Returns 401 for a missing, malformed, expired, or inactive token; 403 for an authenticated identity lacking route, scope, or cluster authorization; 503 when SIS is unavailable. All cases fail closed.