Function verify_signed_advertisement 

pub fn verify_signed_advertisement(
    advert: &SignedCapabilityAdvertisement,
) -> Result<(), CapabilityClaimError>

Verify signature + allow-list. Does not check expires_at clock skew (caller may enforce).