Align governance API schemas with runtime responses

[Copilot]

The governance OpenAPI schemas diverged from the service-state responses for JWT issuers, JWK metadata, and join policies.

• JWT issuers

  • Remove the unsupported preview keyFilter field.

• JWK metadata

  • Model each key ID as an array of entries.
  • Describe publicKey, issuer, and optional constraint fields.

• Join policies

  • Represent SGX and SNP measurements and host-data digests as hexadecimal.
  • Keep virtual measurements and SNP host-data metadata as unencoded strings.

[eddyashton]

Ah this is a mess. We have changed the format of the responses with the 2023-06-01-preview and 2024-07-01 API versions a few times (returning an array of JwkInfos, returning publicKey and constraint fields). The intent of the explicit API versions was to provide a stable API surface, but we've never enforced it, and clearly nobody downstream has noticed/cared. I'm not sure what the right route here is - continue to tweak these previously-generated API docs so they accurately describe the runtime behaviour, but rely on agent audit to keep them in-sync? Revert the runtime changes so the docs are accurate? Introduce a new API version that defers to our existing auto-schema generation to stay in-sync?