[Federation] Add normative text that the Entity Statement claims set is extensible by application protocols

[Vladimir Dzhuvinov]

As explicit client registration does for OpenID Connect / OAuth 2.0 with the “aud” and “trust_anchor_id” claims.

Plus, move those claims from section 3.1 to the Explicit Registration section.

[Vladimir Dzhuvinov]

Addressed by https://bitbucket.org/openid/connect/pull-requests/609/federation-reworks-explicit-registration

[Michael Jones]

We now say "Applications and protocols utilizing Entity Statements MAY specify additional claims."