clarify meaning single use nature of request_uri

There's a potential interoperability issue as it doesn't seem to be explicitly stated whether a request_uri can only be fetched one by a wallet or not.

We've seen wallets that do fetch it multiple times. It's not really clear why they'd do it, but it doesn't seem to be prohibited by the spec, and could happen as a result of a dodgy network connection.

Hence it seems sensible to make sure that a request_uri can be fetched from the verifier more than once, and we might want to add some guidance text in the spec that says that the verifier should tolerate the request_uri being fetched more than once.

https://datatracker.ietf.org/doc/rfc9101/ doesn't really say anything useful on the subject, and there are various references to 'single use' but I think these mean "should only be used by the verifier to once" rather than "should only be fetched one by the wallet".

ref: https://gitlab.com/openid/conformance-suite/-/merge_requests/2089

Start by reviewing the OpenID4VP specification and the cited RFC 9101 references to determine how “single use” and request_uri retrieval are described. Clarify whether wallets may fetch a request_uri more than once and add guidance that reflects the intended verifier behavior.