Explain why nonce is optional now

Co-authored-by: reivilibre <oliverw@element.io>

crates/oidc-client/src/requests/authorization_code.rs

@@ -191,6 +191,7 @@ pub struct AuthorizationValidationData {
     pub state: String,
 
     /// A string to mitigate replay attacks.
+    /// Used when the `openid` scope is set (and therefore we are using OpenID Connect).
     pub nonce: Option<String>,
 
     /// The URI where the end-user will be redirected after authorization.