Introduces NATS.Server.Tls.OcspMode (Auto/Always/Must/Never matching Go ocsp.go constants) and OcspConfig with Mode and OverrideUrls. Adds OcspConfig? and OcspPeerVerify to NatsOptions for stapling configuration and peer certificate revocation checking. Covered by 12 new unit tests.