When downloading a new public key of an issuer of which some public keys had already been used, the new public key would not be parsed resulting in a nil deref during keyshare sessions.

When downloading a new public key of an issuer of which some public keys had already been used, the new public key would not be parsed resulting in a nil deref during keyshare sessions.

- Sessions now start with a SessionRequest instead of the requestor's JWT
- Move protocol version negotiation to later in the protocol to decouple QR contents from SessionRequest
- Fix legacy in protocol
- Support for multiple keyshare servers in issuance sessions

Co-authored-by: Confiks <confiks@scriptbase.org>