clarify if c_nonce is optional or mandatory?

[Sakurann]

currently, HAIP is silent on c_nonce.
Probably makes sense to mandate it.

[lj-raidiam]

The High Assurance name obliges to prevent reply attacks. Makes sense to me. Shall we define any further requirements/recommendations regarding the nonce quality and reusability?

[jogu]

moved to 1.0 as missed deadline for id1.

[jogu]

Discussed on today's WG call: if the issuer issues key bound credentials, then c_nonce is mandatory for issuer. (It's already mandatory for wallets to support if nonce endpoint is present.)