Fixes #885.

The bug

In vcvalidator's verify(), the proofValue branch skips signature verification when requireProof=false (documented as "accept on expiry/revocation only") and falls back to confirming that the verificationMethod DID resolves. That fallback sits behind a non-empty guard:

if vm := cred.Proof.VerificationMethod; vm != "" {
    ...
}

When verificationMethod is empty the block is skipped entirely and verify() returns nil — the credential is accepted having had no verification of any kind performed, and with no error raised to signal it.

This is the same "nothing left to verify" situation as the two sibling cases in the same function — cred.Proof == nil, and a proof carrying neither jwt nor proofValue — both of which already reject with AUT_SIGNATURE_MISSING. This third case was silently accepted instead.

Only reachable on deployments that explicitly set requireProof=false; DefaultConfig() sets it to true.

The fix

Reject with AUT_SIGNATURE_MISSING when verificationMethod is absent, as suggested on the issue, so all three cases are classified consistently.

Testing

Added TestDataIntegrityProofWithoutVerificationMethod, covering the gap noted on the issue (no existing test exercised requireProof=false with an empty verificationMethod).

It fails on main with exactly the reported symptom:

--- FAIL: TestDataIntegrityProofWithoutVerificationMethod
    vcvalidator_test.go:424: expected error of class INVALID_PROOF, got nil

That nil is the defect — the credential passed. With the change the test passes, the rest of the vcvalidator package is green, and go vet is clean.