feat(pki-server): authorize signed OCSP requests

Add per-responder signed-request policies, strict request-signature and
requester-certificate validation, cryptographic principal mapping and
scoped OCSP query authorization.

Preserve public unsigned responder behavior while isolating requester,
transport and administrative identities.

pki/src/main/java/zeroecho/pki/api/algorithm/X509AlgorithmBinding.java

@@ -72,7 +72,9 @@ public record X509AlgorithmBinding(String bindingId, AlgorithmIdentity algorithm
         /** Certificate signature. */
         CERTIFICATE_SIGNATURE,
         /** Certificate-revocation-list signature. */
-        CRL_SIGNATURE
+        CRL_SIGNATURE,
+        /** Signed OCSP request signature. */
+        OCSP_REQUEST_SIGNATURE
     }
 
     /** Authority that owns the OID assignment. */

pki/src/main/java/zeroecho/pki/impl/framework/x509/StandardX509Bindings.java

@@ -402,7 +402,7 @@ public final class StandardX509Bindings {
                     Optional.empty(), commitment));
         }
         return List.of(X509AlgorithmBinding.Role.CSR_SIGNATURE, X509AlgorithmBinding.Role.CERTIFICATE_SIGNATURE,
-                X509AlgorithmBinding.Role.CRL_SIGNATURE).stream()
+                X509AlgorithmBinding.Role.CRL_SIGNATURE, X509AlgorithmBinding.Role.OCSP_REQUEST_SIGNATURE).stream()
                 .map(bindingRole -> new X509AlgorithmBinding(id + "."
                         + bindingRole.name().toLowerCase(java.util.Locale.ROOT), identity,
                         bindingRole, identifier.oid(), X509AlgorithmBinding.Origin.STANDARD, 1, parameters, keyEncoding,