Update CAMARA-ICM-examples.md with CIBA examples

[sebdewet]

What type of PR is this?

• documentation

What this PR does / why we need it:

In CAMARA-ICM-examples.md, add CIBA examples as for Authorization code flow.

Which issue(s) this PR fixes:

Fixes #236

Special notes for reviewers:

optionnal question : In CIBA authentication request, do we define that client_assertion is mandatory ?

[AxelNennker]

What is the status of this? I feel that we agree.
Could we close the open comments thus making clear that the comments were addressed?

• "differ"
  @sebdewet Please consider committing my suggestion:

Please note: All values are example values and can be different from the values provided here.

• returned scopes
  I would not include scopes in the response if they are identical to the ones requested
  Maybe remove them from all examples where requested scopes and returned scopes are the same?!
  The API consumer has to know if the scopes associated with the access token are different to what was requested, but if scopes are not part of the response then the API consumer can be sure that the requested scopes are associated with the access token

[eric-murray]

The CIBA /bc-authorize example should be explicitly labelled as an example of an unsigned request, and this PR would be a good place to correct that.

[jpengar]

@sebdewet, could you kindly review the comments? I believe we can reach a final agreement to close this PR, which is under Spring25 scope, by this week.

[sebdewet]

I updated the examples following your comments.

[diegogonmar]

Suggested change

	In this example, scopes differs from the one defined in the /authorize. If scopes are identical in /authorize and in the successful response, parameter scope isn't returned.
	In this example, scopes differ from the one defined in the /authorize. If scopes are identical in /authorize and in the successful response, parameter scope may not be returned.

[diegogonmar]

I suggest change to may not be returned in order to not mandate an specific behavior in server. OAuth defines as optional when identical, so server can still return scopes in that case