security.md claims attestation content is immutable except for revoked/expiration, but amend_attestation lets issuers mutate metadata

[Haroldwonder]

docs/security.md's "What the admin cannot do" section states: "Modify or delete an existing attestation's content — attestations are immutable once written; only the revoked flag and expiration field can be updated, and only by the original issuer." src/attestation.rs:889-934 implements amend_attestation(env, issuer, attestation_id, new_metadata), which lets the original issuer directly overwrite the metadata field of a live attestation (snapshotting the prior value into AttestationVersionSnapshot history first). This contradicts the stated immutability invariant, and the feature is separately listed as an unimplemented backlog request ("Feature: add attestation amendment with version history") despite already existing in full — the security doc's threat model should be updated to describe what amend_attestation does and does not allow.