Add mTLS support

[sspaink]

resolve: #2

Adds mTLS support for service-to-server traffic (bundle downloads, decision-log uploads, status reports, discovery). Mirrors Go-OPA's services.<name>.tls and services.<name>.credentials.client_tls blocks so existing OPA configs port over.

Additional changes:

• Bundle polling now uses jittered [min, max] delay (matching Go-OPA) instead of the prior scheduleAtFixedRate(maxDelay).

• BundlePlugin.validate now flags references to unknown services up front instead of only logging on first download.

  Config additions

services:
  acmecorp:
    url: https://policy.example.com
    tls:
      ca_cert: /etc/ssl/corp-ca.pem
      system_ca_required: true        # also trust JVM defaults
    credentials:
      client_tls:
        cert: /etc/ssl/client.pem
        private_key: /etc/ssl/client-key.pem    # PKCS#8 only
        private_key_passphrase: "..."           # optional
        cert_reread_interval_seconds: 3600      # optional, for
rotation
    headers:                          # optional, applied via
setHeader
      X-Caller-Identity: "..."

[johanfylling]

Thank you!

Mostly comments and nits; but it would be nice to not pull in the bouncycastle dependency.