making did:x509-backed credential feature production-ready

[reinkrul]

TODOs:

• Write RFC
• Check if all documentation is up-to-date, given the latest insights.
  • https://nuts-node.readthedocs.io/en/latest/pages/deployment/certificates.html#did-x509
• pki.AddTruststore is never called if tls.{certfile,certkeyfile} is not configured #3583
• did:x509 issuer and resolver assume the root CA as ca-fingerprint #3587
• Policy values aren't encoded uzi-did-x509-issuer#11
• generated VCs do not contain an @context defining the X509Certificate and credentialSubject uzi-did-x509-issuer#22
• x5c parsing goes wrong uzi-did-x509-issuer#23 (fix encoding of x5c certificates uzi-did-x509-issuer#25)
• did:x509 JWT x5c field processing incorrectly assumes PEM, should be base64 DER instead #3596
• Validate x5c chain of JWT credentials #3588
• Rename UziServerCertificateCredential to X509Credential uzi-did-x509-issuer#33
• X509Credential validation #3599
• Add X509Credential to JSON-LD context #3600
• Create end-to-end test for did:x509 with X509Credential #3601
• Make GH Actions build and push Docker image of x509-issuer tool (Add GitHub Actions workflow to build and push Docker images uzi-did-x509-issuer#18)

Things up for discussion:

• @stevenvegt's remark regarding credential subject structure: Change credentials to did:x509-backed credentials Zorgbijjou/scp-homemonitoring#7 (comment)
• How are parties going to issue their UZI server certificate? This highly depends on the environment, e.g.: tool that connects to a key vault, or uses an on-disk private key. A locally run CLI tool, or a container that you can start, issues the certificate and loads it into the Nuts node, etc.

[gerardsn]

• probably could use an e2e test
• (how) do credential revocations work?

[woutslakhorst]

How are parties going to issue their UZI server certificate? This highly depends on the environment, e.g.: tool that connects to a key vault, or uses an on-disk private key. A locally run CLI tool, or a container that you can start, issues the certificate and loads it into the Nuts node, etc.

clearly document the issuance process and our requirements so people can make a library. Java library is already under construction.

[woutslakhorst]

docs on certificates are not totally correct. Should be changed together with PR on #3583