Change replay-protection-non-notifications section

[chrysn]

In my review at https://mailarchive.ietf.org/arch/msg/core/yAiNmM9_FxhSIvmXpt4WGt8bBx0, I wrote:

In particular, I'm playing around with wording updates for 6.4.1 -- if this item is acted on before I've made a more concrete suggestion via PR, please remind me to revisit that section.

These are the changes that came out of said playing-around. They are certainly not suitable for direct inclusion, but I think they could be the base for a clearer paragraph. In particular, this

• shift the focus from the differences between single responses, Observe and non-notification exchanges to the commonality, showing how the general rules apply in principle (but can be simplified for special cases),
• remove the limitation that Observe and non-notification exchanges can not be mixed (Why not? That'd be up to the document that describes the new options that introduce non-notification exchanges.), and
• makes things more opt-in (replay protection is only needed for non-idempotent response handlers, ordering is wholly optional)

See also a few comments inline.

[marco-tiloca-sics]

This was addressed when addressing the topic of unified handling of multiple responses at large in https://github.com/core-wg/oscore-groupcomm/pull/107 , now merged and added to version -19 of the Internet Draft [1].

[1] https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm-19