Demote validity-url to optional

[tomokinat]

validity-url has many good aspects as mentioned in the spec and as we do know, but it is usually hard to manage them in a very disciplined manner at scale. Ultimately there's one validity-url per SXG, and even if not we still need a kind of solid system to handle validity-urls to take real advantages of them. After all what we see today are publishers having only one validity-url which returns an empty CBOR map:

amppackager:
https://github.com/ampproject/amppackager/blob/bf061bede4b0280654c25b19fc3cc34e25d13cf0/packager/validitymap/validitymap.go#L31

reddit:

$ curl -s 'https://amp.reddit.com/amppkg/validity' | hexdump -C

00000000  a0                                                |.|
00000001

Even after SXGs infiltrated there might be a non-trivial amount of publishers doing like this. This would simply be a burden to publishers and especially to browsers as they make one extra fetch which essentially does nothing.

It'd be awesome if there's a way to explicitly and officially tell "we don't serve any validity for this SXG" to avoid these extra work.