Add directives for payload sizes

[PatStLouis]

Some credentials are very large, especially when they contain inline svg data. There should be some guidance around this as I've noticed some vc-api implementations are currently returning a failed verification because of a payload exceeding the server's limit. This is also affecting the security of the server and may be part of the instance configuration.