mandate: no trust anchor for the issuer (any HTTPS host can issue) #449

From the adversarial security review on #448 (Important 1).

Gap. mandate::Verifier accepts any issuer whose own server's JWKS signs the mandate. Any HTTPS host that runs an issuer can mint trust: "issuer-attested" mandates, with whatever name/email disclosures it likes, for accounts on its own server. The spec names Plow as the trust root and leaves federation out of v1, but nothing in the verifier enforces it.

What #448 does enforce (spec C2). The issuer is the agent's own server: iss must equal https:// + act.sub's server, and that server must follow Matrix server_name grammar. Keys come only from that server's fixed well-known URL. So a mandate can't pose as another company's issuer. It can only speak for its own server's accounts.

Open question for the spec owner. Should a v1 verifier accept only known Plow company servers? The options:

• Verifier::new takes the accepted issuers: a suffix such as *.swarm.plow.co, plus the companies' custom domains.
• name/email are returned only when the email's domain is bound to the issuer.
• Leave it open, since iss is in the verdict and the persona's owner decides.

Weight. Pulls slightly against the current thrust (ship layer 1 small). Worth deciding before chunk 4 has the bridge show verified: true to people.