Review pending credentials

[macterra]

Follow up to #1062, instead of automatically accepting credentials that are sent via notices, tag them as pending and allow the subject to review before accepting.