FAPI-R: Clarify authorization code reuse requirements

The OpenID Connect and OAuth2 specifications in places use unclear language when
talking about reuse of authorization codes.

This text attempts to state a clear position. The position chosen is
that already documented in one section of RFC6749 4.1.2:

If an authorization code is used more than
once, the authorization server MUST deny the request

In some ways it is not necessary to repeat this as it is already
in RFC6749, however the clause is often missed and OIDCC adds
confusion by adding 'if possible'.

closes #86