Make device attribute optional for explicit subscription requests

[shilpa-padgaonkar]

Problem description
Most Camara APIs follow the guideline added in the design doc to make device object optional and identify the device using the access token when possible. This should also be extended for explicit subscription APIs.

Expected behavior
Make device object optional in subscriptionDetail.

Alternative solution

Additional context
Also will be relevant for #295

[jlurien]

An enhancement to the guidelines should consider as well that if device is returned as part of the response, it should not reveal information not included in the response. Specifically, if device is not included in the request it must not be revealed in the response. This may be considered a separate issue, but this lack of clarification was the reason to keep device as required for the moment in some APIs (e.g. geofencing-subscriptions).

In QoD there is already a mention to this, which could be taken as example:

https://github.com/camaraproject/QualityOnDemand/blob/r1.2/code/API_definitions/quality-on-demand.yaml#L521

Note that the device object is defined as optional and will only to be returned if provided in createSession. If more than one type of device identifier was provided, only one identifier will be returned (at implementation choice and with the original value provided in createSession).

[patrice-conil]

Totally agree with @jlurien.

[jlurien]

I see that there was already an issue opened for this last part: #295