Add Privacy Considerations for Access Token & ID Token potentially leaking data to third-parties

At present, the spec simply says what properties must be included in the Access Token and ID Token, however, it does not specify that you probably shouldn't include more information in your tokens than what is required, as that could be used as an attack vector to exfiltrate data to a malicious actor.

A lot of OAuth 2 / OpenID servers, such as Keycloak and Auth0, present Access Tokens with additional properties, such as email, first name, last name, and phone number. Given how Solid works, the access token returned from Solid OIDC could potentially be sent to a resource server that is malicious (e.g., by having a linked resource that is outside of the management of the Solid provider / intended ecosystem).

It would be very good from a security standpoint to recommend that additional properties not be added to these tokens, as they could be used to collect data without user consent. Instead, those properties should be in their public WebID Profile Document if the user wishes those properties to be public.

In OpenID Connect, there is a /userinfo endpoint, where this information could be made available, but the spec also allows this information to be in the Access Token:

• https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
• https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims

Read the linked Access Token and ID Token sections in the Solid OIDC specification, then compare their requirements with the linked OpenID Connect UserInfo and Standard Claims sections. Clarify where privacy guidance belongs and update the specification so the treatment of additional token properties is explicit; done means the recommendation is documented and consistent with the existing token requirements.