feat(cert_authority): M14.1 — @cert-authority + @Revoked parser (FR-60, FR-64)

Adds the parsing surface for OpenSSH @cert-authority lines and the
Anvil @Revoked shorthand in known_hosts-style files.  The next slice
(M14.2) consumes these in check_server_key for revocation
enforcement; the live cert-during-handshake verification path (FR-61,
FR-62, FR-63) is deferred to a follow-up that lands once russh
exposes the server's certificate to the check_server_key callback
(see M14 plan for the upstream blocker).

src/cert_authority.rs (new, public module):
- struct CertAuthority { host_pattern, algorithm, fingerprint, openssh }
- struct RevokedEntry { host_pattern, fingerprint }
- struct DirectHostKey { host_pattern, fingerprint }
- struct KnownHostsFile { direct, cert_authorities, revoked }
- pub fn parse_known_hosts(content) -> Result<KnownHostsFile, AnvilError>

The parser:
- recognizes @cert-authority and @Revoked markers case-insensitively
  per OpenSSH (markers must be followed by whitespace);
- splits comma-separated host patterns into multiple entries;
- accepts the Anvil-format `host SHA256:fp` direct line as before;
- accepts the OpenSSH-format `algorithm AAAA... comment` pubkey on
  @cert-authority lines (parsed via ssh_key::PublicKey::from_openssh
  for fingerprint computation + algorithm extraction);
- skips hashed entries (|1|...|...) with a debug log; full support
  documented as a follow-up;
- soft-skips malformed @Revoked lines with a warn so an operator
  typo doesn't brick the connection.

src/lib.rs: add `pub mod cert_authority;`.

Tests: 15 new unit tests in cert_authority::tests covering empty
input, comments + blanks, direct lines, comma-separated hosts,
@cert-authority parse + case-insensitive marker + invalid pubkey
error, @Revoked parse + case-insensitive + comma hosts + missing
fingerprint, hashed-entry skip, marker-without-space negative case,
mixed three-class file, whitespace tolerance.  Total now 200 lib
tests, 0 failures, 5 ignored.

Plan: M14.1 of let-us-plan-on-bright-cosmos.md.

Author: UnbreakableMJ