Document digest nonce validation callback

There is no example for DigestStrategy's nonce validation callback right now, which makes it difficult to understand how complete the module's implementation is and if we're less secure if we don't supply such a callback. Also, we don't know what we should actually be doing in that callback, because the only example just returns true.
- Around line 182 of `lib/passport-http/strategies/digest.js` we see that if a validation callback wasn't provided, success is implied, so it appears that some extra verification can be added by this?
- In the JSDoc, it's unclear whether `params.opaque` now will become `params.nonce` later or if they're two different concepts.
- Internal function `nonce()` does seem to generate something unique, so I speculate that we might be safe against replays without a custom validation callback, but it's just an educated guess.

Start with lib/passport-http/strategies/digest.js around line 182, then read the JSDoc and the internal nonce() function. Document what the nonce validation callback verifies, how params.opaque and params.nonce differ, and whether omitting the callback affects replay protection; done means the callback's purpose and expected behavior are clear to users.

Written by the indexing model from the issue text.