add some security considerations text about the scope of the Key Binding JWT

[bc-pi]

as additional explanation in the draft for #277

see it here https://drafts.oauth.net/oauth-selective-disclosure-jwt/scope-of-kb-jwt/draft-ietf-oauth-selective-disclosure-jwt.html#name-key-binding-jwt-2

[Sakurann]

SD-JWT payload in this PR might be replaced with SD-JWT input claim set depending on how PR #306 goes.