Editorial: complete the `target_domain` → `target_origin` sweep and fix assorted nits

[jdoerrie]

Summary: The explainer currently uses target_domain in some places and target_origin in others. The scoping is origin-based (matching Chromium's implementation), so this issue tracks completing the rename to target_origin along with necessary semantic rewrites. Several other editorial gaps are also covered here.

Details:

• Stale target_domain references: README.md:437 ("target_domain property"), which must align with the already-correct README.md:619 and :626 ("A string property called target_origin"). Similar replacements are needed for "parameter" at README.md:451.
• "RP's domain" semantics: README.md:437, :461, :556, :707 ("The Relying Party's domain matches the stored **Target Domain**") need semantic rewriting for origin scoping.
• Subdomain note: README.md:453 ("If the RP wants to keep separate keys for different subdomains…") is written against an older domain/site model and needs updating for the origin scoping model.
• Misspelled JWT key type: README.md:273 ("kt": "EC",). Per RFC 7517, this should be "kty".
• Invalid XSD unions: README.md:514 (type="xs:base64Binary|xs:string") and :524 (type="xs:hexBinary|xs:string"). The type attribute requires a QName, so a named xs:union simpleType is needed instead.
• Three names for one concept: digest_alg (README.md:491), dbsc_key_alg (README.md:542), and provider_key_alg (README.md:209, :433).
• Table of Contents drift: README.md:25-55 is misaligned. ## How is it different from DBSC(E)? (at :85) is missing, and Terminology/Attack-vector order differs from the body.
• Missing Session Provider terminology mapping: While DBSC uses "Session Provider", this explainer consistently uses "Identity Provider". Add a Terminology entry to explicitly map the underlying DBSC spec's "Session Provider" to this document's "IdP".

Proposed change:

• Standardize on target_origin throughout text and examples.
• Rewrite domain-specific mechanics (like the subdomain note and the "RP's domain" sentences) to correctly express origin-bound semantics.
• Fix the "kt" typo to "kty".
• Author a named simpleType for the XML schemas.
• Consolidate algorithm tracking to one name (e.g., provider_key_alg).
• Repair the two TOC defects in place: add the missing How is it different from DBSC(E)? entry and swap Terminology ahead of Attack vector in depth. Note that a plain doctoc re-run is not the right fix here, because the current TOC deliberately starts at Introduction, whereas doctoc would also add entries for Authors, Contributors, Participate, and Table of Content.
• Add a terminology mapping equating Session Provider from the DBSC baseline with the IdP in this explainer.

[lucasrsant]

The pull request #17 partially addresses this issue, such as:

• Standardize on target_origin throughout text and examples.
• Rewrite domain-specific mechanics (like the subdomain note and the "RP's domain" sentences) to correctly express origin-bound semantics.
• provider_key_alg is completely dropped from the explainer as it is no longer necessary.

I can address the remaining parts in a separate pull request to keep their scopes narrower.