explicitly note idempotence requirement on upload requests

draft-ietf-ppm-dap.md

@@ -1013,6 +1013,9 @@ Aggregators MAY require Clients to authenticate when uploading reports (see
 {{client-auth}}). If it is used, HTTP client authentication MUST use a scheme
 that meets the requirements in {{request-authentication}}.
 
+The handling of the upload request by the Leader MUST be idempotent as discussed
+in {{Section 9.2.2 of !RFC9110}}.
+
 To generate a report, the Client begins by sharding its measurement into input
 shares and the public share using the VDAF's sharding algorithm ({{Section 5.1
 of !VDAF}}), using the report ID as the nonce: