jurisdiction-flag: add doc comments to require_compliance_authority and require_issuer explaining the auth split

[Idaonoli]

Scope

jurisdiction-flag has two distinct auth-gating helpers (require_issuer, strict; require_compliance_authority, issuer-or-officer), and per-function doc comments don't consistently say which one gates a given entry point or why — worth a focused pass on just these two helpers and their callers, narrower than the existing open all-public-functions doc-comment issue.

Acceptance criteria

• Add doc comments to require_issuer and require_compliance_authority explaining the intended authorization split, and a one-line note on each gated function saying which helper it uses