HttpCtrl: install the vendored 0.3.1 fork + align D011_02_exc stub URL

requirements.txt was pinning upstream robotframework-httpctrl==0.3.3, which ships a stub matcher that requires the criteria URL to exactly equal the stub URL. That defeats every distop test where the broker appends spec-mandated parameters (pick=…&sysAttrs=true&…) to the forwarded URL — see testsuite-doubts.md #22 (closed). The vendored fork at libraries/robotframework-httpctrl/ is 0.3.1 with a distop-aware substring matcher; it's been orphaned (nothing installed it) since the requirements bump.

• requirements.txt: switch the pin to -e ./libraries/robotframework-httpctrl/ so the local fork actually runs.
• D011_02_exc.robot: the stub URL hardcoded the deprecated attrs=speed query param. Spec § 5 says attrs is a synonym for pick + q and is deprecated; the broker forwards with the canonical pick=. Switched the stub to pick=speed so the new substring matcher reaches it. (Even with the new matcher, the original attrs= token wasn't a substring of the broker's pick=… URL.)
• testsuite-doubts.md #76 (closed): documents a second-order finding surfaced by the above two changes — when the mock now correctly serves the stub body, the broker still drops the CSR's speed from the merged response because HttpCtrl can't add a Link header and the broker falls back to default-core context (different IRI from the local entity's). Two-sided issue; broker-side fix needs spec review.

Together these two changes don't flip D011_02_exc_01 itself (waiting on #76 (closed)), but a full ETSI re-run shows ~8 cascade-timeout tests flipping to pass (the matcher upgrade) plus 8-10 other distop tests newly reaching end-to-end and surfacing the same #76 (closed) pattern for triage.