docs(access-rules): define indeterminate formula evaluation

[Martin187187]

Summary

This PR clarifies how access-rule formulas behave when an expression cannot be evaluated.

Changes

• Introduces indeterminate for runtime failures such as unresolved or inapplicable FieldIdentifiers, missing or unusable claims, and invalid casts.
• Defines complete truth tables for combining true, false, and indeterminate with $and, $or, and $not.
• Clarifies the behavior of logical operators with more than two operands and permits result-preserving short-circuit evaluation.
• Ensures that only a final result of true activates an ALLOW rule; false and indeterminate never grant access.
• Distinguishes runtime indeterminate results from invalid access-rule documents, which are rejected before evaluation.

Validation

• python tools/validate_spec_artifacts.py
• python -m unittest discover -s tests/query

Closes #96

[Martin187187]

Securtiy TF: this change makes sense because:
Main rationale: Different behavior depending on evaluation order (e.g., indeterminate $or true vs. true $or indeterminate) should be avoided. We do not want to enforce strict evaluation (i.e., all subterms are required to be evaluated in any case) to allow optimized implementations.