Saving the field settings form silently drops require_identity_mint on non-assurance gate methods

Problem/Motivation

The per-field mint setting require_identity_mint is honored at runtime for any gate method: MintController checks it (alongside the global require_acting_account) and refuses a mint that names no acting account. But on the signed_url method, SignedUrl::fieldSettingsSubmit() persists only ttl, available_until and max_uses — require_identity_mint has a form control only on the assurance method.

Result: on a field storage configured with require_identity_mint: true (for example via config import), any editor who opens the field configuration form and presses Save — even without touching anything — silently strips the flag from the stored method_settings. Identity-bound grants degrade to unbound signed URLs: the mint endpoint stops requiring an acting account, so the identity-aware access walk (host view, field view, nested parent view) is skipped entirely for that field.

This is a silent security downgrade. On a config-managed site the next config:import restores the flag, but between the form save and the next deploy the protection is off, with nothing logged and no visible diff outside the config system. On a site without config management the downgrade is permanent.

Steps to reproduce

1. Gate a file field with method signed_url and set require_identity_mint: true in the field storage's third-party settings (config import or settings form of a method that exposes it).
2. Confirm a mint without an acting account is refused (403, "This field requires an acting account").
3. Open the field's configuration form in the admin UI and press Save without changing anything.
4. Mint again without an acting account: it now succeeds. The stored third-party settings no longer contain require_identity_mint.

Proposed resolution

Either surface require_identity_mint as a checkbox on every gate method's field settings form (it is method-agnostic at enforcement time), or make fieldSettingsSubmit() preserve method_settings keys it does not manage instead of rebuilding the array from its own form values. Preserving unknown keys is the safer default: a future setting added to the controller would otherwise reintroduce this class of bug. A kernel test should pin that a form-shaped submit round-trip keeps require_identity_mint.