Demote `validity-url` to optional

validity-url has many good aspects as mentioned in the spec and as we do know, but it is usually hard to manage them in a very disciplined manner at scale. Ultimately there's one validity-url per SXG, and even if not we still need a kind of solid system to handle validity-urls to take real advantages of them. After all what we see today are publishers having only one validity-url which returns an empty CBOR map:

amppackager:
https://github.com/ampproject/amppackager/blob/bf061bede4b0280654c25b19fc3cc34e25d13cf0/packager/validitymap/validitymap.go#L31

reddit:

$ curl -s 'https://amp.reddit.com/amppkg/validity' | hexdump -C

00000000  a0                                                |.|
00000001

Even after SXGs infiltrated there might be a non-trivial amount of publishers doing like this. This would simply be a burden to publishers and especially to browsers as they make one extra fetch which essentially does nothing.

It'd be awesome if there's a way to explicitly and officially tell "we don't serve any validity for this SXG" to avoid these extra work.

Start by reviewing the validity-url discussion in the web packaging specification and the referenced amppackager implementation at packager/validitymap/validitymap.go. Determine how an SXG can explicitly indicate that it has no validity data, then update the specification so validity-url is optional and the no-validity behavior is defined.