Holder can (re)create authentic credentials after receiving a credential in vp-toolkit

Summary

### Impact The [`verifyVerifiableCredential()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.ts#L57) method check the cryptographic integrity of the Verifiable Credential, but it does not check if the [`credential.issuer`](https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L129) DID matches the signer of the credential. The **verifier** is impacted by this vulnerability. ### Patches Patch will be available in version 0.2.2. ### Workarounds In case you trust certain issuers for certain credentials as a verifier, trust the issuer's public key from the `credential.proof.verificationMethod` field. ### References [Github issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13) ### For more information If you have any questions or comments about this advisory: * Discuss in the existing [issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13) * [Contact me](https://github.com/rabomarnix)