Add LDAP Distinguished Name Helper and Credential Audit Context

- Implemented LdapDistinguishedNameHelper for escaping RDN and filter values.
- Created AuthorityCredentialAuditContext and IAuthorityCredentialAuditContextAccessor for managing credential audit context.
- Developed StandardCredentialAuditLogger with tests for success, failure, and lockout events.
- Introduced AuthorityAuditSink for persisting audit records with structured logging.
- Added CryptoPro related classes for certificate resolution and signing operations.

docs/10_OFFLINE_KIT.md

@@ -14,7 +14,8 @@
 | **Container images** | Scanner + Zastava for **x86‑64** & **arm64** |
 | **Cosign signatures** | Release attestation & SBOM integrity |
 | **SPDX SBOM** | Cryptographically signed bill of materials |
-| **Import manifest** | Check‑sums & version metadata |
+| **Authority plug-ins & manifests** | `plugins/authority/**` now contains the Standard + LDAP plug-in binaries, hashes, and sample manifests (`etc/authority.plugins/*.yaml`) so air-gapped operators can drop them into `/plugins/authority` without rebuilding. |
+| **Import manifest** | Check‑sums & version metadata |
 
 Nightly **delta patches** keep the bundle < 350 MB while staying *T‑1 day*
 current.