fix(sdjwt): require terminal aud and nonce claims

[Silentpartnercoding]

Description

Terminal KB-SD-JWT verification now rejects an absent, empty, or non-string
aud or nonce claim even when the caller does not supply an expected value.
The existing exact-match checks remain unchanged when expectations are given.

RFC 9901 section 4.3 requires aud as a single string and nonce as a
string. Delegate SD-JWT section 5.1.4 requires KB-SD-JWTs to conform to the
KB-JWT requirements except for its listed changes, none of which relax these
claims. This also matches kb_sd_jwt.create(), which already rejects empty
values.

This is a structural-conformance check only. When no expectations are given,
presence does not establish that the audience is the correct receiver or that
the nonce is fresh; callers still need to provide expectations for those
semantic checks.

This change also:

• adds direct, holder-signed terminal-token regressions for missing aud and
  missing nonce with both expectations left at their defaults, covers both
  accepted terminal typ spellings, and rejects present-but-empty values;
• corrects the SDK wire-format documentation, which described these required
  terminal claims as optional;
• labels two existing diagram fences so the edited README passes markdownlint;
• registers existing SDK terms encountered when CI spellchecks the complete
  modified files.

Validation

• 17 passed — kb_sd_jwt_tests.py
• 192 passed, 2 deselected — full Python SDK suite excluding two failures
  reproduced unchanged on upstream main:
  kb_sd_jwt_intermediate_tests.py::test_verify_rejects_aud_mismatch and
  kb_sd_jwt_intermediate_tests.py::test_verify_rejects_nonce_mismatch
• Ruff check and format check pass for changed Python files.
• Markdownlint passes for the changed SDK README.
• git diff --check passes.

Baseline CI note

The repository-wide Lint Code Base job currently fails in unchanged
code/web-client/** and docs/assets/** files (75 existing Biome errors plus
warnings). The same required job is red on related PRs #313 and #326. This PR
does not change the lint policy or those unrelated files; its changed-file
Ruff and Markdown checks pass, and the separate repository spellcheck job is
green.

• Followed the CONTRIBUTING guide.
• Used a Conventional Commits PR title.
• Added regression coverage and ran relevant lint checks.
• Updated the affected documentation.

Fixes #319 🦕