Unify the three OneTimeUse diagnostics

[shreemaan-abhishek]

What

PR #53 leaves the OneTimeUse-and-the-record concept voiced three ways within ~220 lines of lua/resty/saml.lua:

• the no-dict case: a dedicated ngx.log(ngx.WARN, ...) in assertions_acceptable
• the record-will-lapse case: a structured buffer in spend_assertions flushed after the loop
• the full-dict case: a ternary suffix on the no-memory ERR

They share neither wording nor fields, and four anchored test regexes pin three templates, so a cross-cutting change to how the SP names an assertion in these lines has to be made three times in three syntactic forms, and nothing catches the three drifting apart.

Each shape is load-bearing where it stands (the no-dict warn fires where the config gap is known, the lapse warn defers for the rollback, the full-dict line rides the ERR because it is the same failed add), so unification is a design task rather than a find-replace: a shared formatter over {id, issuer, zone?, outcome} that each site feeds, or a decision that three shapes are the accepted cost.

Raised by @jarvis9443 reviewing #53 (r3894613411).

[shreemaan-abhishek]

One more rendering seam for this pass: the diagnostics render a missing value two ways. A nil id prints as the token nil (loggable goes through tostring), while a nil issuer prints as nothing at all (or ""), so one line can carry both renderings. Whatever shape the unified messages take should pick one placeholder for an absent value and use it for every field.