fix: reject changed MPP challenges after approval

[brendanjryan]

Motivation

The CLI refreshes an MPP challenge after user approval. A refreshed challenge must not change the terms that the user approved.

Summary

• Retain the approved challenge through the spend request flow
• Compare refreshed challenge terms before attaching the approved credential
• Reject changes to payment, merchant, or intent fields

Key design considerations

• Allow challenge identifiers and expirations to refresh
• Compare the canonical challenge representation for all other fields
• Leave direct payment with an existing spend request unchanged because no original challenge is available