Dispose manifest is missing `cfm.vpa.credentials` for onboarding revocation

[thomasrutger]

onboarding-dispose requires cfm.vpa.credentials, but tmanager does not include that field in the dispose orchestration payload.

On deploy, tmanager adds cfm.vpa.credentials to the manifest, so onboarding can request credential issuance. On dispose, it only sends participant ID, VPA data, and saved state, but not the credential specs. As a result, onboarding-dispose fails when reading onboardingData, because CredentialSpecs is marked as required.

[paullatzelsperger]

for dispose we don't need the cfm.vpa.credentials. So to me, the cleanest solution would be to define another struct, call it offboardingData or similar, that does not have the CredentialSpec property.