Support authorization delegation to a different organization

[woutslakhorst]

NutsAuthorizationCredentials require the authorizer as issuer. There are scenarios were a third party should be able to issue authorization credentials for a care organization. A medical call center is one of those examples, the call center operates as a separate entity but should be able to authorize a (whitelisted) care organization in case of an emergency.

This might require a new type of credential (MandatedOrganizationCredential?) but would also have impact on the way an access token is issued. Multiple credentials together would be valid for giving access.... We have to be careful not to require a rule-engine for this, as this will probably be error prone.