Add guidance to verifiers/issuers and clients/client platforms on cross-origin usage

[timcappalli]

Both get and create calls are allowed in cross-origin iframes in the spec. These cross-origin requests can be confusing and even misleading to users.

We should:

1. Add considerations for verifiers and issuers, similar to WebAuthn
2. Consider adding non-normative recommendations to clients/client platforms on displaying both the origin and top origin to users on selection screens

[npdoty]

Agreed that cross-origin usage will be confusing to users and ripe for abuse. Is that something we need to support?

W3C specs have in the past included recommendations around showing a pair of origins to the user (around geolocation, for example), but as I understand it most browsers have abandoned that because of user confusion.

[hlflanagan]

Discussed on the DC API call - 11 August