Add IAR related OID4VP requirements to OID4VP section

[awoie]

We have requirements for DC API and Redirect flows but we should probably also think about requirements for OID4VP when used with IAR, e.g., PKCE etc.

[Sakurann]

I would suggest below requirements. anything else?

• PKCE mandatory
• response mode must be iar-post.jwt (ie response encryption)
• openid4vp_presentation MUST be supported as one of interaction_types_supported
• The Wallet MUST support both signed and unsigned requests. The Verifier MAY support signed requests, unsigned requests, or both.

[awoie]

I would suggest below requirements. anything else?

• PKCE mandatory
• response mode must be iar-post.jwt (ie response encryption)
• openid4vp_presentation MUST be supported as one of interaction_types_supported
• The Wallet MUST support both signed and unsigned requests. The Verifier MAY support signed requests, unsigned requests, or both.

I don't think we have to mandate certain interaction types since IAE lacks implementation experience and a formal security analysis but we should like you said recommend things like PKCE etc.