Assurance: accept a list of trusted issuers, each with its own audience and accepted acr

Problem/Motivation

The assurance gate method pins exactly one issuer and one audience per gated field: AssuranceVerifier::verify() compares iss byte-exact against a single configured issuer and requires a single configured audience, and the field-level required_acr list applies to whatever token passed. A deployment with more than one trusted identity provider — for example a staff realm plus a customer realm, or environment-qualified audiences on a shared realm — cannot express "accept tokens from these issuers, each with its own audience and its own accepted acr values".

Anything other than "everyone authenticates in one realm" needs a list.

Proposed resolution

Add a trusted_issuers list to the assurance method settings. Each entry carries issuer, audience, and required_acr. Matching rules, all fail-closed:

- An incoming token selects exactly one entry by byte-exact iss. No cross-matching: a token from issuer A can never satisfy issuer B's audience or acr list.
- No laxer fallback: an unknown iss is rejected, before any JWKS discovery request is made (the unverified iss only selects among admin-configured entries, never supplies a URL, so the existing SSRF property is preserved).
- Signature verification still uses the configured entry's JWKS via OIDC discovery; iss is re-checked byte-exact after verification.
- Two entries with the same issuer are a configuration error; the set is invalid and verification fails closed.
- The matched entry's required_acr drives the acr decision. The flat field-level list survives only to advertise acr_values in challenges (the union across entries).

Backwards compatibility: the existing single-issuer settings shape (issuer, audience, required_acr) keeps working, treated as a one-entry list at read time. No update hook.

Remaining tasks

Development happens on the project's GitHub repository (Wilkes-Liberty/file_gate, issue #60); the merge request / PR will be cross-linked here for review.