Issuance request forwarding: Documenting the threat

[simoneonofri]

This PR adds the issuance request forwarding threat to the Security Considerations threat model.

The threat captures the case discussed in #382 where a malicious holder's credential manager, such as a digital wallet, is selected by the user during issuance and forwards the issuance request data to another credential manager on an attacker-controlled device.

Addressing this threat remains under discussion in #382.

Related to #382.

---

Preview | Diff

[c2bo]

We should probably add a note that authorization steps in the protocol might mitigate this? So the result doesn't have to be the issuance to complete.

Something like this?

Suggested change

	causing issuance to complete with that other credential manager
	rather than with the credential manager selected by the user.
	causing issuance to complete with that other credential manager
	rather than with the credential manager selected by the user. Note
	that the success of such an attack also depends on possible
	authorization steps performed by the underlying
	[=digital credential/issuance protocols=].

[marcoscaceres]

The "the success of such an attack" reads a little weird.

Projecting forward to the actual mitigation text, what mitigations are in place, for instance, in Openid4vci?

With an example of a mitigation, we might be able to reframe the note a bit.

[TallTed]

Is it the holder that is malicious, or is it the credential manager? A little rephrasing should be done to make this clear.