Retrieving all client metadata from client_metadata parameter seems too restrictive

[jogu]

We have this text under several of the client id schemes, e.g. x509_hash:

"All Verifier metadata other than the public key MUST be obtained from the client_metadata parameter."

I'm not 100% sure what we intended here to be honest (given we define a very limited set of things to be valid inside client_metadata parameter), but I think we need to tweak this to be clear that it's okay to get a client name from the x509 certificate, and HAIP explicitly suggests other things like (e.g.) valid response_uri values could come from the x509 certificate.

[brentzundel]

@dpostnikov has agreed to raise a PR so that the group can come to agreement on the language changes needed.

[dpostnikov]

On the DCP WG call yesterday, there was agreement that the current statement is wrong, and something needs to be said.

We couldn't agree on whether this should be a security consideration, or, alternatively, couldn't come up with a MUST clause that is normative and testable.

I've tried to create a PR that conveys the message as a security consideration.

#735

Please review