Add --payload-location option for IndirectSignature

[JeromySt]

• Add payloadLocation parameter to IndirectSignatureFactory methods
• Add --payload-location CLI option to IndirectSignCommand
• Wire payload location through CoseHashEnvelopeHeaderExtender (label 260 per RFC 9054)
• Add tests for payload location in both factory and plugin tests
• Update IndirectSignaturePlugin.md documentation
• Update SCITTCompliance.md with Payload Location section

closes #157

In general, to fix this pattern, replace dictionary.ContainsKey(key) followed by dictionary[key] with a single dictionary.TryGetValue(key, out var value) and use value for subsequent checks. This consolidates two lookups into one and avoids a potential KeyNotFoundException.

In this specific test, we should replace the assertion that checks for the key with a TryGetValue call that also retrieves the description. Then we can assert that the retrieved description contains "URI". Concretely, in IndirectSignCommand_Options_ShouldContainPayloadLocationOption in CoseSignTool.IndirectSignature.Plugin.Tests/IndirectSignCommandTests.cs, replace the two lines:

Assert.IsTrue(options.ContainsKey("payload-location"), "Options should contain payload-location");
Assert.IsTrue(options["payload-location"].Contains("URI"), "payload-location description should mention URI");

with code that first asserts TryGetValue succeeds, captures the option description into a local variable, and then checks that this string contains "URI". No new imports or helper methods are needed; we only use existing IDictionary<string,string> APIs and MSTest assertions.