Separate out HTTP signatures from the message signing spec

[Dave Tonge]

We discussed on the call today and agree to take the http sig part of message signing out to a sep spec.

This is because it is slowing us down in moving to final with message signing and is not an immediate requirement of any of the ecosystems looking at FAPI 2 (as far as we know)

[Dave Tonge]

https://bitbucket.org/openid/fapi/pull-requests/519

[Brian Campbell]

No objection to the split