feat: change duty from single element to array

[mkollenstart]

What this PR changes/adds

Changes duty property to be always an array.

Why it does that

Allow flexibility with respect to ODRL policies.

Linked Issue(s)

Closes #157

[arnoweiss]

What would be a best practice to use the Duty object in the Permission as opposed to Policy?

[mkollenstart]

From my interpretation of the ODRL spec, the primary distinction is that an obligation of a policy must always be fulfilled to let the policy be active whereas an duty property in a permission/prohibition only applies to that specific rule.

A policy, from the ODRL perspective, can consist of only obligations without any permissions/prohibitions, but I can't see any use case within a dataspace where this would be relevant.

For conciseness, an argument could be made that an obiligation on policy level automatically applies to all rules. But from an implementation perspective, explicitly setting the duty property on rule level and not allowing obiligations on policy level can make it easier to implement. Also, it is already unclear for us what the exact difference is and when to use which variant so explaining this to others is relatively difficult.

The question to would then be to choose between:

• Not narrowing down ODRL and support both the obligation property on policy level and the duty property on rule level.
  Pro's: more flexibility for unforeseen use-cases and no requirement to explain why we deviate from ODRL.
• Narrowing ODRL in the scope of the DSP to only allow the duty property on rule level.
  Pro's: easier to implement and to understand.

For reference, the relvant snippets from the ODRL spec:

Obligation property with a Policy

A Policy MAY include an obligation to fulfil a Duty. The obligation is fulfilled if all constraints are satisfied and if its action, with all refinements satisfied, has been exercised.

Duty property with a Permission

A Duty MAY be specified as a pre-condition that requires fulfillment using the duty property relationship from the Permission to the Duty.

If a Permission has several Duties then all of the Duties MUST be agreed to be fulfilled. If several Permissions refer to the same Duty (via its uid property), then the Duty only has to be fulfilled once.

[arnoweiss]

increases consistency with the Policy.obligation property