Register a SCITT Signed Statement and get its COSE Receipt

IETF SCITT registration under the riskrouter-scitt-profile|1 policy: a COSE_Sign1 hash envelope (protected 258 = -16, 32-byte payload), ES256, kid = the id of a key registered with POST /api/v2/evidence/keys, CWT claims iss and sub. The log keeps one leaf holding SHA-256 of the statement with its unprotected header emptied. Returns an RFC 9942 COSE Receipt and the Transparent Statement, base64.