feat: secure ledger internal endpoints

[ramioooz]

Summary

• Add stateless Spring Security resource-server support to Ledger Service.
• Require ledger.internal scope for /internal/v1/ledger-entries/**.
• Keep health/info and OpenAPI endpoints available for probes and internal documentation.
• Validate issuer and base64 HMAC JWT configuration using the existing platform contract.
• Add focused decoder configuration coverage without redundant unit tests.

Verification

• ./mvnw -Dtest=JwtDecoderConfigurationTest test
• ./mvnw -DskipTests package
• Full unit suite during package: 36 tests passed.
• git diff --check

Notes

• This PR does not merge directly to main.
• Runtime deployment must provide auth.jwt.secret through the existing secret-backed configuration and auth.jwt.issuer.