DOCS: Agent signature element specification

[jwrosewell]

Adds the behaviour contract for the agent signature element that
51Degrees/pipeline-dotnet#373 implements. The element checks the
request signature an automated agent sends under the IETF Web Bot
Auth protocol and reports whether the signature verified, with an
absent signature never reading as evidence against a request.

The page follows the shape of set-headers-element.md and keeps to
the contract rather than the .NET API: the evidence the element asks
for, the thirteen step status and reason decision order (five
statuses, seventeen reason codes), the key directory cache semantics
including the wait budget, the Timeout outcome and the
stale-while-refreshing rule with its one further lifetime bound, the
fetch safety rules (HTTPS only, no user information, private and
loopback addresses refused, redirects refused, response bytes
capped), the twelve properties, and the configuration options with
their defaults and validation.

The .NET implementation in pipeline-dotnet#373 is the reference for
the other language ports, and every behaviour stated on the page was
checked against that code rather than written from memory. The one
part of the contract that depends on other repositories is the web
evidence for @method, @path, @query and @target-uri, which
51Degrees/pipeline-dotnet#374 tracks, and the page says those read
Unverified with ComponentUnavailable until the evidence exists.