add optional support for historical status resolution

[c2bo]

Adds support for historical resolution of status as an optional feature.

Closes #138
Rendered Version: https://drafts.oauth.net/draft-ietf-oauth-status-list/c2bo/historical-resolution/draft-ietf-oauth-status-list.html

I will take another look at the wording / normative text and mark as ready for review when I am done.

[c2bo]

todo:

• fix the references to this in privacy considerations
• fix some wording / language

[decentralgabe]

the language looks good, thanks for including it.

I will only add that while there may be privacy risks, there are legitimate business cases that require such historical data, such as guaranteeing compliance with financial regulation. In these cases, user privacy is made better by using this specification (as opposed to amore privacy-eroding solution), even if maximal privacy is not achieved. I hope the privacy section can speak to this nuance.

[paulbastian]

The whole text is in the Security Considerations section. I believe we should move the normative text to the section 8.

[c2bo]

The whole text is in the Security Considerations section. I believe we should move the normative text to the section 8.

Good point - I moved the whole part to the end of Section 8.