fix: prevent lost and partial revocations in the status list

[paullatzelsperger]

What this PR changes/adds

• BitstringStatusListFactory now reads the status list credential with CredentialStore#queryForUpdate, introduced in
  fix: prevent duplicate status list indices on concurrent issuance #1104. The status list credential therefore stays locked until the surrounding transaction completes.
  • The StatusListInfoFactory javadoc documents that a status change must be made within that transaction.
• CredentialStatusServiceImpl#revokeCredential rolls back its transaction when the status list credential or the
  revoked credential cannot be written. It still returns the original failure as a ServiceResult.
• CredentialStatusServiceImpl#revokeCredential now returns a failure when the credential's current status cannot be
  read from the status list.

Why it does that

• Lost revocations: a revocation reads the status list credential, sets a bit, re-signs it and writes back the
  entire row. Without a lock, two concurrent revocations on the same status list could overwrite each other. The
  credential's record would say REVOKED, but the published status list would not.
• Reused indices: a revocation could also write back a stale currentIndex, so indices handed out in the meantime
  were handed out again.
• Partial writes: both writes happen in one transaction, but LocalTransactionContext only rolls back on exceptions.
  If the second write failed, the first one was still committed, and the status list and the issuer's records disagreed.
• False success: when the current status could not be read, the method returned mapFailure() of a successful
  result. That is a successful result, so the revocation reported success without changing anything.

Linked Issue(s)

Closes #1105

🤖 Generated with Claude Code