Record 1.x compatibility commitments and base64url scope

[jmanico]

The future compatibility queue lacked explicit dispositions, leaving optional proposals open to being treated as implementation commitments. Record each 1.x keep/defer decision with consumer evidence, migration cost and the process required before accepting a future break. Link the record from the consumer and contribution guides.

Resolve the base64url proposal as out of scope: use the JDK byte codec when the protocol requires it, document padding/canonicalization/Unicode/resource-limit boundaries, and add no public codec, facade or view binding. No breaking proposal is accepted and no speculative implementation tickets are created. Java 8, published API/module identities, dependency scopes and existing ESAPI delegates remain unchanged.

Validation: documentation-only diff and local links checked; the byte example compiled with javac --release 8 and printed AAEC on JDK 17. The JDK decoder's acceptance of padded/unpadded input was checked. Sol review and final Astra review found no actionable findings on 70720012ab25d5218ef16811fbd6ef2f29127c44; all 28 final-head checks passed before merge. No artifact inputs change, so the batch 05 clean-build comparison remains applicable.

Closes #142. Refs #149 (closed as not planned after merge), and batch 06 in #169. No release, removal date or 2.0 promise is introduced; #110/#111 and the complete 1.5 release gate remain open.