Implement VEX document verification system with issuer management and signature verification

- Added IIssuerDirectory interface for managing VEX document issuers, including methods for registration, revocation, and trust validation.
- Created InMemoryIssuerDirectory class as an in-memory implementation of IIssuerDirectory for testing and single-instance deployments.
- Introduced ISignatureVerifier interface for verifying signatures on VEX documents, with support for multiple signature formats.
- Developed SignatureVerifier class as the default implementation of ISignatureVerifier, allowing extensibility for different signature formats.
- Implemented handlers for DSSE and JWS signature formats, including methods for verification and signature extraction.
- Defined various records and enums for issuer and signature metadata, enhancing the structure and clarity of the verification process.

src/Policy/StellaOps.Policy.Engine/Scoring/RiskScoringModels.cs

@@ -117,6 +117,20 @@ public enum RiskScoringJobStatus
 /// <summary>
 /// Result of scoring a single finding.
 /// </summary>
+/// <param name="FindingId">Unique identifier for the finding.</param>
+/// <param name="ProfileId">Risk profile used for scoring.</param>
+/// <param name="ProfileVersion">Version of the risk profile.</param>
+/// <param name="RawScore">Raw computed score before normalization.</param>
+/// <param name="NormalizedScore">
+/// DEPRECATED: Legacy normalized score (0-1 range). Use <see cref="Severity"/> instead.
+/// Scheduled for removal in v2.0. See DESIGN-POLICY-NORMALIZED-FIELD-REMOVAL-001.
+/// </param>
+/// <param name="Severity">Canonical severity (critical/high/medium/low/info).</param>
+/// <param name="SignalValues">Input signal values used in scoring.</param>
+/// <param name="SignalContributions">Contribution of each signal to final score.</param>
+/// <param name="OverrideApplied">Override rule that was applied, if any.</param>
+/// <param name="OverrideReason">Reason for the override, if any.</param>
+/// <param name="ScoredAt">Timestamp when scoring was performed.</param>
 public sealed record RiskScoringResult(
     [property: JsonPropertyName("finding_id")] string FindingId,
     [property: JsonPropertyName("profile_id")] string ProfileId,