fix(tls): avoid unverified OCSP status claims

[ryanfowler]

Summary

• require an OCSP CertID match before showing an embedded certificate status
• show a neutral staple-present indication when the issuer is unavailable or no response matches
• remove semantic status colors from OCSP data that is not signature and freshness validated
• document the conditional OCSP inspection output

Tests

• cargo test --locked --all-features --lib tls::inspect::tests::parse_ocsp_status -- --nocapture
• cargo test --locked --all-features --lib tls::inspect::tests::render_ocsp_status -- --nocapture
• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features --lib --bins
• cargo test --locked --all-features --test cli --test formatting --test grpc --test har --test http --test install --test network --test terminal --test update --test websocket -- --test-threads=2