Key resolver: check expires/revoked against reference time

Parent PRD

#4079

What to build

Extend DIDKeyResolver.ResolveKeyByID() to check Expires and Revoked fields on the verification method against the reference time (ResolveMetadata.ResolveTime) before returning the key.

Per PSA 10.4.3, key resolution selects the correct key and validates:

• The reference time must be before the Expires date (if set)
• The key must not be marked as Revoked with a revocation date before the reference time

If the key was expired or revoked at the reference time, it should not be returned (return an appropriate error).

This is a generic mechanism — it works for any DID method that sets Expires/Revoked on its verification methods, not just did:x509.

Acceptance criteria

• ResolveKeyByID checks Expires against ResolveMetadata.ResolveTime — rejects if key was expired at reference time
• ResolveKeyByID checks Revoked against ResolveMetadata.ResolveTime — rejects if key was revoked before reference time
• A key that was valid at the reference time but later expired/revoked is accepted (PSA 10.4.3)
• When ResolveTime is nil (current time), standard time-based checks apply
• Existing key resolution behavior is unchanged for DID methods that don't set these fields
• Unit tests for: expired key rejected, revoked key rejected, key valid at issuance but later revoked accepted, key without expires/revoked accepted

Blocked by

• Blocked by #4082 (expires/revoked fields on VerificationMethod in go-did)
• Can be done in parallel with #4083 (did:x509 resolver changes)

User stories addressed

• User story 6: key validity checked at credential's issuance time
• User story 8: layered validation model follows PSA spec

Start with DIDKeyResolver.ResolveKeyByID() and the ResolveMetadata.ResolveTime and verification method fields described in the issue; review blocked issue #4082 first. Add checks and unit tests for expiry, revocation, historical validity, and unset fields, while preserving behavior for methods that do not set them.