OpenIDVP kid and x5c not together

[peppelinux]

Since it is up to the RP decide which client id scheme to use, the use of kid or x5c must be selected according to the trust evaluation method used

therefore kid and x5c should be conditional required and not absolutely required
https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/remote-flow.html#request-object

however, the RP knows the trust evaluation method supported by a wallet instance if it obtain the wallet metadata (optional during the request flow) or configuring different authnetication button configured with different trust evaluation method, considering login with eudiw using client id scheme x509_hash as mandatory and the x5c jwt header required as well.

see: #1118

[manuraf]

I suggest adopting a similar approach to #1118 for the x5c parameter.

Currently, kid is marked as strictly required. However, its necessity in the Request Object depends entirely on the client_id_scheme chosen by the RP, also to avoid mixing mechanisms as discouraged by the OpenID4VC specifications:

If the RP adopts the openid_federation scheme: The kid parameter is strictly necessary to resolve the key through the federation metadata and the trust chain. Otherwise, if the RP adopts the x509_hash scheme its validation mechanism shifts to x5c.

Proposed Change

I propose integrating a text similar to the following:

REQUIRED when the client_id_scheme is openid_federation. OPTIONAL when the the RP uses the x509_hash scheme. ..