Provide stronger guidance on locating X.509 chain in COSE/JWS

[letmaik]

Even though it is not a direct concern of the DID method specification but rather of a signing envelope profile, it is beneficial to provide strong guidance since there is only one obvious place for the certificate chain to go, both in COSE and JWS.

For COSE, it would be the x5chain (label 33) header parameter, see https://www.iana.org/assignments/cose/cose.xhtml#header-parameters.

For JWS, it would be the x5c header parameter, see https://www.iana.org/assignments/jose/jose.xhtml#web-signature-encryption-header-parameters.

This is in line with the DID resolution spec which defines a draft HTTP binding and uses standard HTTP headers where available for resolution options.

Ideally, in the future, there is a single JWS/COSE binding specification for DID-issued content, but that will take a while.

[OR13]

Ideally, in the future, there is a single JWS/COSE binding specification for DID-issued content, but that will take a while.

I wonder if we might be able to define this as part of w3c/vc-data-model#971