LoTE registry: treat presence-in-list as trusted when ServiceStatus is absent

[leifj]

Problem

Per ETSI TS 119 602 v1.1.1, most entity type profiles (PID, Wallet, WRPAC, WRPRC, Registrar) forbid the ServiceStatus field. For these profiles, presence in the list = trusted, and withdrawal means removal from the list entirely.

Only the Pub-EAA profile uses ServiceStatus (notified/withdrawn) to indicate trust state.

The go-trust LoTE registry currently filters on ServiceStatus when evaluating trust. This means entities from non-Pub-EAA profiles (which correctly omit ServiceStatus) would not be recognized as trusted.

Required changes

The LoTE registry should:

1. When ServiceStatus is present: use it as a trust signal (notified/granted = trusted, withdrawn = not trusted)
2. When ServiceStatus is absent/empty: treat presence in the list as trusted (implicit trust model)

This applies to both entity-level and service-level evaluation.

Reference

• ETSI TS 119 602 v1.1.1, clause 6.6.4 and Annexes D–I
• ServiceStatus is profile-dependent per ETSI TS 119 602 Annexes D–I g119612#30
• https://github.com/AniaAlex/publish-trusted-list/blob/main/project_lote_entity_type_profiles.md
• Raised by @AniaAlex in feat: add XML LoTE support and LoTL cascading resolution #35 (comment)