Unify the three OneTimeUse diagnostics #57

What

PR #53 leaves the OneTimeUse-and-the-record concept voiced three ways within ~220 lines of lua/resty/saml.lua:

• the no-dict case: a dedicated ngx.log(ngx.WARN, ...) in assertions_acceptable
• the record-will-lapse case: a structured buffer in spend_assertions flushed after the loop
• the full-dict case: a ternary suffix on the no-memory ERR

They share neither wording nor fields, and four anchored test regexes pin three templates, so a cross-cutting change to how the SP names an assertion in these lines has to be made three times in three syntactic forms, and nothing catches the three drifting apart.

Each shape is load-bearing where it stands (the no-dict warn fires where the config gap is known, the lapse warn defers for the rollback, the full-dict line rides the ERR because it is the same failed add), so unification is a design task rather than a find-replace: a shared formatter over {id, issuer, zone?, outcome} that each site feeds, or a decision that three shapes are the accepted cost.

Raised by @jarvis9443 reviewing #53 (r3894613411).