[WALLET-425] Allow insecure result URI in x401 Result Artifact decoding

[frostevent]

Ticket: https://notarize.atlassian.net/browse/WALLET-425

What changed

• verifier.decodeResultArtifact(header, options) and parseResultArtifact(value, options) accept { allowInsecureUri }. When it is set, an http credential_result_uri is accepted, so a verifier can use a http://localhost transport during local development. Without the option, the URI must still be https.
• The https check is shared by return_uri and credential_result_uri, through isAllowedUri.
• InsecureUriOptions is exported, and ReturnUriOptions is kept as an alias of it so existing callers keep compiling.

Testing

• yarn check-all passes: format, lint, typecheck, 41/41 tests, publint.
• New tests cover an http credential_result_uri accepted under allowInsecureUri, and a non-string URI still rejected.
• Exercised locally in verifier-vcp-demo against a localhost notarize-api.

🤖 Generated with Claude Code