Integrate MIAF and WFM identity profile SUPs

[matlec]

Description

Integrates the two voted MIAF SUPs into the concepts and lexicon. This is the non-normative companion to the specification PR.

• Margo Identity and Authorization Framework (Margo Identity and Authorization Framework (MIAF) specification-enhancements#38)
• WFM Identity Profile (WFM Identity Profile specification-enhancements#58)

What changes

• Adds an Identity and Trust concept page under a new Concepts > Identity section. It explains the Trust Domain model, SVIDs, the MIS role, and mutual TLS, with a diagram and links into the normative spec.
• Rewrites Device Client Onboarding around MIAF. Operator-provisioned identities and mutual TLS replace the root-CA download, the WFM-assigned client identifier, and per-request payload signatures.
• Updates the Device Capabilities wording so capability reporting happens when the client first connects rather than at onboarding.
• Adds an Identity Terms group to the technical lexicon: Trust Domain, SPIFFE ID, SVID, Trust Bundle, Margo Identity Service, Principal, WFM Identity, and WFM Client Identity.

Issues Addressed

• Define Margo strategy for ecosystem identity and authorization specification#127
• Complete WFM client onboarding strategy following the MIAF SUP finalization specification#146

Change Type

Please select the relevant options:

• Fix (change that resolves an issue)
• New enhancement (change that adds specification content)
• Content edits (change that edits existing content)

Checklist

• I have read the CONTRIBUTING document.
• My changes adhere to the established patterns, and best practices.

[phil-abb]

I did an initial review and didn't spot anything to comment on.