organization_facility_type has no source on the GF Sandbox auth path

[JorisHeadease]

The Mitz consent check requires organization_facility_type, and nothing on the planned GF Sandbox authentication path supplies it.

The gap

validateMitzInput fails the check when the field is empty:

• component/pdp/mitz.go:141-144 lists input.Subject.Organization.FacilityType among the required values, with the message "Could not complete Mitz consent check: Missing subject organization facility type".
• component/pdp/mitz.go:101 sends it as the requesting facility type in the closed question.

Because the Mitz check runs before Rego evaluation (component/pdp/component.go:142-150), an empty facility type fails the decision regardless of what the policy itself allows. The BGZ policy never sees it: component/pdp/policies/bgz/policy.rego reads only input.context.mitz_consent, which the Mitz PIP has already computed.

Why neither planned credential supplies it

• The organization X509Credential maps organization_ura from the certificate SAN otherName (config/policy/policy.json:56-66). The demo certificate encodes the URA there and nothing else usable as a facility type (test/e2e/pep/certs/issue-cert.sh).
• The Dezi v0.7 attestation carries abonnee_nummer, abonnee_naam, dezi_nummer and the role claims. There is no facility type in the subject the Nuts node extracts (vcr/credential/dezi.go).

The existing PEP e2e flow gets around this by sourcing it from a self-asserted delegation credential: test/e2e/pep/testdata/accesspolicy.json maps field id organization_facility_type from $.credentialSubject.facilityType, and test/e2e/pep/authorization_test.go:377-381 supplies "facilityType": "Z3" in the HealthCareProfessionalDelegationCredential.

What to decide

Whether the BGZ presentation definition takes the same route (a self-asserted credential carrying facilityType), derives the value from the organization credential, or gets it from somewhere else. A presentation-definition field id becomes the introspection claim name verbatim, so whatever is chosen has to emit exactly organization_facility_type.

Related: #550 covers the same class of problem for user_id versus user_uzi.

Refs #540