Add compliance test suite for security invariants

[maxmalkin]

Summary

Adds a comprehensive compliance test suite with 64 tests verifying critical security invariants:

• token_security (12 tests): Token canonical bytes, hash comparison, expiry/empty validation
• behavioral_envelope (11 tests): Rate limiting, burst limits, human presence requirements
• dpop_binding (8 tests): DPoP proof generation, JTI uniqueness, thumbprint determinism
• nonce_replay (6 tests): Nonce uniqueness, length, entropy, replay detection
• capability_boundary (12 tests): Capability validation, manifest boundary enforcement
• audit_integrity (19 tests): Hash chain integrity, tamper detection, event ordering