feat(secureservice): enforce admission tokens

[ZanzyTHEbar]

Summary

• Add a provider-neutral inbound admission enforcement wrapper around credential checking.
• Add public NewWithAdmissionVerifier wiring so callers can inject an AdmissionVerifier without package-private mutation.
• Fail fast when admission is enabled by config without a verifier, until JWKS/config construction lands in a later stack slice.

Stack

• Fourth PR in the federated admission stack.
• Depends conceptually on feat(secureservice): add admission primitives #680, feat(secureservice): add JWT admission verifier #681, and feat(secureservice): carry admission tokens #682.
• Draft until the lower stack lands; review as the delta after feat(secureservice): carry admission tokens #682.

Security

• Admission remains disabled by default.
• Required admission rejects missing tokens before invoking the verifier.
• Denials map to existing invalid-credentials handshake behavior; no token or verifier details are sent to peers.
• Network ID is only read when admission is enabled, preserving existing mock/runtime behavior for disabled deployments.

Validation

• PASS: go test ./net/secureservice ./net/secureservice/handshake
• PASS: go test ./... -run '^$'
• PASS: go test ./net/transport/quic ./net/transport/webtransport ./net/transport/yamux
• PASS: worktree review after public constructor fix found no findings.
• KNOWN PRE-EXISTING FAIL: go test ./... still fails at net/rpc/limiter TestLimiter_Concurrent_Bursts with the same threshold instability observed before this stack.

[ZanzyTHEbar]

/oc please review this draft stacked PR, focusing on the delta after #682