docs: address the MIAF pre-draft security review

[matlec]

Description

This PR addresses the MIAF findings of the security review in #226.

Main changes:

• Trust Bundle retrieval: a client that trusts public CAs rejects a trustBundleUri from the discovery document on another origin. The trustDomain check becomes a MUST. Bundle entries whose certificate is not a CA certificate are ignored. Clients randomize and limit the refresh interval, signal an old bundle, and log a spiffe_sequence regression. The SPIFFE ordering rules stay unchanged, so existing SPIFFE deployments stay conformant.
• TLS baseline: no TLS 1.3 early data, the TLS 1.2 fallback is off by default, the connection from a TLS-offloading proxy to the backend must be protected, and clients use an authenticated time source where one is available.
• SVIDs: a verifier rejects a presented chain of more than six certificates and RSA keys with an exponent below 65537.
• Framework and WFM profile: the MIS does not issue a /margo/ path that no identity profile defines, and the framework states what MIAF does not take over from SPIFFE. An identity failure stops Management Interface calls but does not stop deployed workloads.
• Security considerations: a minimal list of security events, new threat rows (replay, local tampering, trust endpoint denial of service, see-thru gateways), and threat tables that cross-reference their rules instead of restating them.
• Management Interface: the 403 prose names the registered not-authorized problem type, and the digest 404 descriptions are scoped to the calling client.

Some findings belong to the MIAF SUPs and are in margo/specification-enhancements#84 and margo/specification-enhancements#95. The findings outside MIAF stay open in #226.

Issues Addressed

• Contributes to MIAF pre-draft security review #226 (does not close it)

Change Type

Please select the relevant options:

• Fix (change that resolves an issue)
• New enhancement (change that adds specification content)
• Content edits (change that edits existing content)

Checklist

• I have read the CONTRIBUTING document.
• My changes adhere to the established patterns, and best practices.