Function parseCredentialRequest

Parses and validates a credential request for the configured IT-Wallet version.

Performs the following validations in order:

1. Authorization header — asserts the Authorization HTTP header is present and uses the DPoP scheme with a non-empty access token. The extracted token is returned as accessToken for subsequent verification by the caller.
2. DPoP proof header — asserts the DPoP HTTP header is present and contains a compact JWT. The extracted JWT is returned as dpopProof for subsequent cryptographic verification by the caller (e.g. via verifyTokenDPoP).
3. Request body schema — validates the body against the v1.0 or v1.3 schema.
4. Semantic checks — verifies optional expected values (audience, nonce, issuer, credential_identifier, credential_configuration_id).
5. Transaction context — enforces transaction_id presence/absence rules for deferred vs. immediate issuance flows.
6. Proof JWT structure — decodes each proof JWT and validates its header and payload claims, including iss requirements for the authorization_code grant. For v1.3, asserts the key_attestation header claim is present and non-empty. For requests using proofs.jwt (including v1.3 and v1.4), validates batch proof key uniqueness with RFC7638 JWK thumbprints. This function does not perform cryptographic signature verification on proof JWTs or the DPoP proof. Both must be verified separately after parsing. For DPoP proofs, the caller can use the verifyTokenDPoP function exported by io-wallet-oauth2.