Log the tokenexchange verifier's bounded rejection reason server-side

mapVerifyError's bounded reason (expired, keys_unavailable, unknown_origin, invalid_token) is never logged today — middleware.go and handler_token.go check the Validate error only for context cancellation, then write the 401 and drop it. With the one-shot JWKS fetch, a GitLab signing-key rotation becomes a 100% 401 storm with zero server-side log lines while Ready() stays green.

Proposed fix (from review on !950 (merged)):

A WarnContext call in the middleware's rejection branch, logging the bounded reason (safe — the one-401 policy only constrains the wire, not server-side logs).
A length-capped, quoted origin_claim field at the verifier's unknown-origin rejection specifically, so an operator has the one datum needed during an issuer-side origin rollout (a new origin value minted before this enum learns it), without touching the returned error.