test(acl): submit writes an INGEDIEND record, and records are readable back (refs #153)

Ports and failing tests for the ACL half of S-19b-2, ahead of the implementation.

Once the projection is sourced from Objecten (ADR-0028's stated direction), a submitted
registration has to exist in the register the moment the zaak is opened — otherwise
re-sourcing silently drops every INGEDIEND row, since today only approval writes a record.
So `OpenZaakAsync` gains a second write, and approval upserts that same record to
INGESCHREVEN.

The subscriber gets only an object URL on an `objecten` notification (the payload carries no
record data) and may not read Objecten itself (§8.1), so `IRegisterRecordGateway` gains a
read and `AclService` exposes it.

Red:
- AclService does not yet write on open → the record assertion fails on an empty list.
- ObjectenGateway.GetAsync is a shell throwing NotImplementedException; its tests pin the
  contract: fetch the object URL directly (no objecttype resolution, no search), the CRS
  header a geo API requires, static Token auth, and a 404 read as "nothing to project"
  rather than an error (§8.6).

services/acl/Acl.Infrastructure/ObjectenGateway.cs

@@ -38,6 +38,9 @@ public sealed class ObjectenGateway(HttpClient http, ObjectenOptions options, IC
                 "Updating the register record", ct);
     }
 
+    public Task<RegisterRecord?> GetAsync(Uri objectUrl, CancellationToken ct = default)
+        => throw new NotImplementedException();
+
     private RecordDto NewRecord(int typeVersion, RecordDataDto data) =>
         new(typeVersion, data, clock.Today.ToString("yyyy-MM-dd"));