Add important privacy/security considerations for DCQL

[danielfett]

• When credential matching via claim_sets, the presence/absence of certain claims might leak data (all claims used for deciding response must be included in consent)
• Response must be the same, whether there is no match for credentials or the user didn't consent.

[danielfett]

Also, issue #300 🎉

[bc-pi]

Also, issue #300 🎉

This is that, no?

[danielfett]

Also, issue #300 🎉

This is that, no?

This was just for those who celebrate round numbers.

Anyway, there's a PR now: #469