Add LDAP Distinguished Name Helper and Credential Audit Context

- Implemented LdapDistinguishedNameHelper for escaping RDN and filter values.
- Created AuthorityCredentialAuditContext and IAuthorityCredentialAuditContextAccessor for managing credential audit context.
- Developed StandardCredentialAuditLogger with tests for success, failure, and lockout events.
- Introduced AuthorityAuditSink for persisting audit records with structured logging.
- Added CryptoPro related classes for certificate resolution and signing operations.

src/Authority/StellaOps.Authority/StellaOps.Authority.Plugins.Abstractions/AuthorityCredentialAuditContext.cs

@@ -0,0 +1,30 @@
+using System;
+
+namespace StellaOps.Authority.Plugins.Abstractions;
+
+/// <summary>
+/// Ambient metadata describing the client/tenant/network responsible for a credential verification attempt.
+/// </summary>
+public sealed record AuthorityCredentialAuditContext(
+    string? CorrelationId,
+    string? ClientId,
+    string? Tenant,
+    string? RemoteAddress,
+    string? ForwardedFor,
+    string? UserAgent);
+
+/// <summary>
+/// Provides access to the current <see cref="AuthorityCredentialAuditContext"/>.
+/// </summary>
+public interface IAuthorityCredentialAuditContextAccessor
+{
+    /// <summary>
+    /// Gets the current credential audit context for the executing scope, if any.
+    /// </summary>
+    AuthorityCredentialAuditContext? Current { get; }
+
+    /// <summary>
+    /// Pushes a new credential audit context for the lifetime of a scope.
+    /// </summary>
+    IDisposable BeginScope(AuthorityCredentialAuditContext context);
+}