fix: add requirement on Nonce payload to contain an actual random value

[millenc]

This PR addresses issues: #6 and #22 (duplicated).

Changes introduced by this PR:

• The non-normative Nonce payload example now includes a jti claim and a disclaimer stating that it MUST always contain a random unique value
• RFC4086 has been added to the normative references section
• Some minor fixes on keyword usage

[peppelinux]

I also would suggest (I can do it later on anyway) to change the text 1. **Generation**: Nonces are generated by the server, while jti is generated by the Client. in the section nonce vs. jti, since this seems quite false

this is not related to your PR but to the harmonization we want with your PR

[millenc]

I also would suggest (I can do it later on anyway) to change the text 1. **Generation**: Nonces are generated by the server, while jti is generated by the Client. in the section nonce vs. jti, since this seems quite false

this is not related to your PR but to the harmonization we want with your PR

Agreed. It would be more accurate to state that the jti claim is generated by the token issuer, whomever that may be (typically the server but not always).