Warn of the dangers of malicious text

[danielfett]

Fixes #259

[danielfett]

Applies to claims as well (everything, really).

JSON Schema might be malicious as well (e.g., via a regex).

[bc-pi]

the rat hole is deep ...

[awoie]

I agree with @bc-pi that the rat hole is very deep and we should probably refrain from scratching the surface only.

[bc-pi]

I agree with @bc-pi that the rat hole is very deep and we should probably refrain from scratching the surface only.

Or be sufficently clear that we are just scratching the surface and not even trying to be comprehensive.

[awoie]

Suggested change

	## Risks Associated with Displaying Textual Information {#risks-displaying-textual-information}
	The `display` property in the Type Metadata allows providers of metadata to
	specify human-readable labels and descriptions for claims. Likewise, `name` and
	`description` can contain arbitrary textual information that may be displayed to
	developers. As such, any consuming application MUST ensure that maliciously
	crafted information cannot be used to compromise the security of the application
	or the privacy of the user. To this end, the following considerations apply:
	- The consuming application MUST ensure that the text is properly escaped before
	displaying it to the user or transferring it into other contexts. For example,
	if the data is displayed in an HTML document, the text MUST be properly
	escaped to prevent Cross-Site Scripting (XSS) attacks.
	- The consuming application MUST ensure that the display of the user interface
	elements cannot be distorted by overly long text or special characters.
	## Risks Associated with Textual Information {#risks-textual-information}
	Some claims in the SD-JWT VC and properties in the Type Metadata, e.g., `display`, allows issuers and providers of metadata to
	specify human-readable information. These can contain arbitrary textual information that
	may be displayed to developers. As such, any consuming application MUST ensure that maliciously
	crafted information cannot be used to compromise the security of the application
	or the privacy of the user. To this end, the following considerations apply:
	- The consuming application MUST ensure that the text is properly escaped before
	displaying it to the user or transferring it into other contexts. For example,
	if the data is displayed in an HTML document, the text MUST be properly
	escaped to prevent Cross-Site Scripting (XSS) attacks.
	- The consuming application MUST ensure that the display of the user interface
	elements cannot be distorted by overly long text or special characters.

[awoie]

I agree with @bc-pi that the rat hole is very deep and we should probably refrain from scratching the surface only.

Or be sufficently clear that we are just scratching the surface and not even trying to be comprehensive.

I tried to make suggestions to this PR to make it more general. This would be another option.