[stir] Proposed JWT Constraints Syntax

[Russ Housley <[e-mail]>]

 JWTClaimConstraints ::= SEQUENCE {
   mustInclude [0] JWTClaimNames OPTIONAL,
      -- The listed claim names MUST appear in the PASSporT in addition to iat, orig, dest
      -- If absent, iat, orig, dest MUST appear in the PASSporT
   permittedValues [1] JWTClaimPermittedValuesList OPTIONAL }
      -- If the claim name is present, the claim MUST contain one of the listed values
    ( WITH COMPONENTS { ..., mustInclude PRESENT }
   | WITH COMPONENTS { ..., permittedValues PRESENT } )

JWTClaimPermittedValuesList SEQUENCE SIZE (1..MAX) OF JWTClaimPermittedValues
JWTClaimPermittedValues ::= SEQUENCE {
    claim  JWTClaimName,
    permitted  SEQUENCE SIZE (1..MAX) OF IA5String }

JWTClaimNames ::= SEQUENCE SIZE (1..MAX) OF JWTClaimName
JWTClaimName ::= IA5String