Issued VCs never get cleaned up

When a VC gets issued, it is always stored in the VCR issuer store. This is to keep track of what is issued and to be able to revoke credentials. This was probably designed with low credential count in mind, so no pruning was needed at time when this got designed. Maybe even with the NutsAuthorizationCredentials the number were low enough not to consider pruning.

However, every data access request (or once per user session), an EmployeeID credential is issued and stored. To avoid an ever-growing store (with data that became irrelevant), we might need to consider pruning issued credentials.

The issue names no files, tests, or entry points. Start by locating the VCR issuer store and the code paths that issue and revoke credentials, then determine what lifecycle or retention rules already exist. Done should include an agreed pruning policy, implementation coverage for issued credentials, and tests showing that obsolete entries are removed without preventing revocation.