Tunnel configuration

[mmccool]

Add description of "tunnel" NAT traversal configuration. Also some cleanup on proxy configuration descriptions.

[mmccool]

Note: my cleanup of the proxy descriptions also broke the text across multiple lines at phrase boundaries. We agreed to do this in general to make merge diffs easier to read, but there were very large blocks of text all on one line... unfortunately, that will make this merge harder to read.

[mmccool]

Need to add discussion of "shadows" as well. But this also known as "digital twin" and "caching proxy". Probably best to use "caching proxy'' as the main term but mention the other terms.

[mmccool]

"Fixing the images" unfortunately required me to basically redraw them using inkscape. Can we please author things in SVG in the first place? Powerpoint is not a very good diagram editor, and its file format is not an open standard.

[ereshetova]

Some minor comments:

• I guess one figure is missing (figure for "The second sub-variant, shown in , takes advantage of the metadata provided by the Thing Description") or should both sub-cases refer to figure 10 (links are missing now)?
• I think this might need more clarification: "The cache can either be combined with the security endpoint proxy or can be instantiated as a separate service or "middleware layer"." At least I don't understand what it means...
• "In both of these sub-patterns, object security (that is, encryption of payloads at the application level) can be used to preserve confidentiality if necessary [COSE]. A caching proxy can simply store and return copies of the encrypted data representing the state of "private" properties." - we have to remember to tell that also authenticity/integrity of data is needed in such cases, not just encryption. Plain encryption is vulnerable to too many attacks and rarely used only on its own.

[mmccool]

Do any fixes in a new PR.