[vmarkop]

This PR adds OAuth 2.0 Attestation-Based Client Authentication (ABCA) to wallet-as, with optional WE BUILD profile checks.

Changes:

• Add OID4VC_PROFILE env param with values DEFAULT or WEBUILD.
• Validate ES256 attestation signatures against configured certificate trust anchors and requires DPoP for ABCA token requests.
• Apply configurable attestation and proof-of-possession age limits for default OID4VC Profile.
• Add WEBUILD checks for wallet metadata, attestation lifetime, WIA/DPoP key equality, and revocation status for WEBUILD OID4VC profile. Status retrieval restricts origins and bounds response and decompression sizes.

Configuration required

Deployment requires ABCA_CHALLENGE_SECRET: a shared 64-character hexadecimal secret across AS replicas. wwWallet/wwwallet#71 brings this variable to your local installation. WEBUILD additionally requires WEBUILD_ABCA_STATUS_LIST_ALLOWED_ORIGINS.

This PR changes the wallet client 1233 in oauth2clients.json to use attest_jwt_client_auth as a token_endpoint_auth_method. Ensure you add that auth method to clients you would like to use ABCA for, or remove it if you do not want to use it.

Configuration and profile behavior are also documented in the README and environment template.

Manual verification: complete issuance with an ABCA-capable wallet under DEFAULT, then enable WEBUILD and verify that valid attestations succeed while revoked status or mismatched DPoP keys are rejected. Ensure that local issuance works both with a client using attest_jwt_client_auth and with a non-abca client.