Normatively define how an SD-JWT VC is returned in vp_token

[jogu]

Specify that each SD-JWT VC presentation is a string containing an SD-JWT or SD-JWT+KB in the compact serialized format from Section 4 of the SD-JWT specification, and that the JWS JSON Serialization must not be used, as agreed in the working group discussion today.

closes #780

[dpostnikov]

Discussed on the APAC call today:

• Feedback from the WG was requested.
• @jogu, to update for 1.0 as well?
• "The JWS JSON Serialization defined in Section 8 of [@!I-D.ietf-oauth-selective-disclosure-jwt] MUST NOT be used." need to be further qualified.

[c2bo]

• @jogu, to update for 1.0 as well?

Agreed, this should imho go into 1.0 errata as well

[jogu]

Both points resolved. I did actually mean to put it into 1.0 errata but forget. Then remembered and forgot again. So I agree it should be there.

[brentzundel]

Discussion in group: We need to see if this is needed after #726. It may work to land this one anyway.

[jogu]

Discussion in group: We need to see if this is needed after #726. It may work to land this one anyway.

Even if we reference a version of SD-JWT VC that includes the changes in https://github.com/oauth-wg/oauth-sd-jwt-vc/pull/425/changes I think we still need this text to make clear that, even if an ecosystem decides to fully define a JSON serialisation, that it needs to have a different credential format identifier than the compact serialisation.