"If the Credential Issuer provided a c_nonce" doesn't really make sense

We should replace all 3 instances with "If the Credential Issuer has a nonce_endpoint", the current text is a hangover from when c_nonce was provided in credential/token endpoint responses. (Although one of the instances may be removed by #676 )