Security considerations reated to trusting the TLS certificate

Capturing from https://github.com/solid/solid-oidc/pull/18/files#r781105146

@leifj:
A general comment is that this is not strictly true. Since the AS fetches the WebID document of the user it relies on being able to trust the TLS certificate of the WebID URL. This implies that the AS shares a common trust-anchor with the OP. This assumption should at the very least be called out. There are deployment scenarios where trusting the "normal web trust anchors" (aka webpki) is not desirable.

@acoburn:
It is true that the AS may share the same the same trust-anchor as the OP w.r.t the TLS certificate chain. But that is different than relying on a pre-existing (direct) trust relationship between the the AS and OP.

In other words, given a certificate chain X

AS --> trusts X cert chain
OP --> trusts X cert chain

But this does not imply

AS --> trusts OP

@leifj: trust is in this case transitive. It is probably best to clarify this point in the text.

Start with the specification text discussed in the linked pull request review, especially the passage about the AS fetching the user's WebID document. Clarify the assumption about trusting the WebID URL's TLS certificate and distinguish shared certificate trust anchors from direct trust between the AS and OP; done when the security consideration is explicit.