Update with ideas from reviewing XARF and OMA SpamRep.

Some reprhasing, and:

* Updated to use URIs instead of email addresses for reporter identity
* Relaxed requirement for domain-name in Report-ID from "must" to "SHOULD", for enviroments where there is no obvious domain.
* Allow multiple "evidence" MIME parts
* Update "Source" field definition to use something like a URI, and discard "Source-Type" field.
* Split Date into Reported-Date and Incident-Date
* Add Incident-Lifetime field