Burn nonce type SessionStore entries after first use

[gerardsn]

closes #3063

rewrote nonce validation in handleAuthorizeResponseSubmission since it assumed the first VP contained the "correct" nonce and later on did a second validation over all VPs