feat(acl): resolve zaaktype + informatieobjecttype by business key, not a pinned URL (refs #113)

The ACL now discovers its BIG zaaktype (by identificatie) and diploma
informatieobjecttype (by omschrijving) from OpenZaak's Catalogi API, instead of
being handed server-assigned URLs in config. A CachedZaaktypeCatalog resolves
lazily on first use and caches (success only, so a pre-publish miss is retried);
AclDefaults now carries ZaaktypeIdentificatie/InformatieobjecttypeOmschrijving.
Clear errors replace the opaque placeholder-URL 400. Unit tests cover the
resolver (resolve/cache/retry-on-failure) and the gateway lookups (match/miss).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/acl/Acl.Api/Program.cs

@@ -11,6 +11,8 @@ builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
     .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
     ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
 builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
+// Singleton so the resolved zaaktype/informatieobjecttype URLs are cached across requests (S-27).
+builder.Services.AddSingleton<IZaaktypeCatalog, CachedZaaktypeCatalog>();
 builder.Services.AddScoped<AclService>();
 
 var app = builder.Build();