feat(auth): carry structured principal identity in Identity.Subject

What

Change auth.Identity.Subject from an opaque string to a structured relationships.Subject (origin, origin_id, local_id), so the forthcoming authorization decision layer can pass the authenticated principal straight to the IAM relationships lookup without a second parse. Foundational for wiring ReadRelationships → GLAZ Check on the request path (S28 / OCI-pull demo).

Changes

• relationships.OriginFromClaim(string) (Origin, error) + ErrUnknownOrigin — maps the JWT gitlab.origin claim ("organization", "gitlab_federated") onto the Origin enum; an unrecognized value is an error, not a silent OriginUnspecified.
• auth.Identity.Subject → relationships.Subject, plus Identity.IsAnonymous() — the zero-value-subject discriminator the assembly uses to skip the relationships lookup for anonymous requests.
• tokenexchange verifier now builds the subject from the verified token's gitlab claim (origin/origin_id/local_id) instead of the raw sub, and rejects a verified token whose origin names no known origin (a zero-value principal must never slip through as anonymous).
• authtest fake and the affected auth/server/cmd tests updated for the structured subject.

Testing

• New: TestOriginFromClaim (mapping + unknown/empty rejection), TestIdentity_IsAnonymous, and a TestValidate_Rejects "unknown gitlab origin" matrix case.
• Updated: verifier happy-path, context propagation, server identity propagation, and the token-exchange e2e assertions now check the structured subject.
• go build ./..., the affected package tests, and golangci-lint on the changed packages are green.

No request-path consumer yet — this only restructures the identity the auth layer already establishes. The authorization middleware that reads it lands in follow-up MRs (wireGLAZ, then the OCI-pull assembly).

Related to gitlab-org/gitlab#605903 (closed)