Add registry revocations endpoint

[edip-dev-01]

What Problem This Solves

Issue #24 asks the registry to serve revocations per issuer. PR #39 created signed revocations.json files and local CLI enforcement, but the registry had no way to publish or fetch those lists.

Why This Change Was Made

This adds issuer-scoped revocation list storage to the registry and CLI helpers so revocation checks can use registry-hosted signed lists.

User Impact

• Registry publishers can upload signed revocation lists with qcap publish-revocations.
• Consumers can fetch issuer lists with qcap fetch-revocations.
• qcap open can verify against a registry-hosted list using --revocations-url.
• The demo now proves a revoked capability is blocked through the registry endpoint.

Evidence

• go test ./... in services/qcap-registry
• cargo check --workspace
• cargo test -p qcap-cli
• powershell -ExecutionPolicy Bypass -File scripts/demo.ps1

Fixes #24