Accept nonce-bearing Space DPoP proofs

[haileyok]

Summary

• Fix PDSLS credential-exchange failures caused by nonce-bearing DPoP proofs.
• Accept the optional nonce claim used by @atcute/oauth-crypto while preserving Space DPoP validation.

Changes

• Allow an optional nonce claim in Space DPoP proofs and validate that it is a non-empty string.
• Add nonce support to Cocoon’s proof helper for complete protocol/test coverage.
• Keep issuance proofs unbound to ath; Space credential issuance still rejects an ath claim.
• Add a regression test reproducing a nonce-bearing issuance proof.

Validation

• go test ./space -run TestDPoPProofAcceptsOptionalNonce -count=1
• go test ./... -count=1
• go test -race ./... -count=1
• go vet ./...
• git diff --check

Review notes

• This is based on current main, which includes the Bearer delegation-token compatibility fix from PR Accept Bearer delegation tokens for Spaces credential exchange #128.
• Not deployed; after deployment, retry PDSLS credential exchange with a fresh proof.