add Artifact Registry/Auth Platform interface agreement

Why is this change being made?

This is the handbook port of the doc (internal).

Changes from the original contract:

• The signing key in the interim state. The doc described CustomersDot signing key but after this feedback, it will be a signing key coming from glgo.
• The need of temporarily support 2 signing keys for key rotation purpose.
• Scrapping all the component names
• Switch the language around signing keys to single issuer keys

Author and Reviewer Checklist

Please verify the check list and ensure to tick them off before the MR is merged.

• Provided a concise title for this Merge Request (MR)
• Added a description to this MR explaining the reasons for the proposed change, per say why, not just what
  • Copy/paste the Slack conversation to document it for later, or upload screenshots. Verify that no confidential data is added, and the content is SAFE
• Assign reviewers for this MR to the correct
  • The when to get approval handbook section explains when DRI approval is required
  • The who can approve handbook section explains how to identify the DRI
  • If the MR does not require DRI approval, consider asking someone on your team, such as your manager.
  • The approver may merge the MR. If they approve but don't merge, you can merge.
• For transparency, share this MR with the audience that will be impacted.
  • Team: For changes that affect your direct team, share in your group Slack channel
  • Department: If the update affects your department, share the MR in your department Slack channel
  • Division: If the update affects your division, share the MR in your division Slack channel
  • Company: If the update affects all (or the majority of) GitLab team members, post an update in #whats-happening-at-gitlab linking to this MR
    • For high-priority company-wide announcements work with the internal communications team to post the update in #company-fyi and align on a plan to circulate in additional channels like the "While You Were Iterating" Newsletter

Commits

• docs: add Artifact Registry/Auth Platform interface agreement

Migrate the Auth contract (v0.5) from Google Doc into the handbook, defining the R1-R6 interface between the Artifact Registry and the Auth Platform (token exchange, validation, payload, policy evaluation, relationships API, bootstrapping) for both the target and interim states.

---