Fix invalid http status code about DPoP initial response from 401 to 400

[dutkiewicz]

According to docs, when a request without nonce is made, Bluesky will respond with HTTP 401 Unauthorized. But it's not true, in fact it returns HTTP 400 Bad Request. That's even covered in the demo app.

This PR fixes this typo.

[bnewbold]

It depends on whether the Auth Server (PDS or entryway, doing a token request) or Resource Server (PDS, for authorized XRPC requests) is doing DPoP.

For the Auth Server, HTTP 400 and a response body is the correct response:

[...] the authorization server responds to requests that do not include a nonce with an HTTP 400 (Bad Request) error response per Section 5.2 of RFC6749 using use_dpop_nonce as the error code value.
https://datatracker.ietf.org/doc/html/rfc9449#section-8

For the resource server, it is HTTP 401 and the WWW-Authenticate header:

Resource servers use an HTTP 401 (Unauthorized) error code with an accompanying WWW-Authenticate: DPoP value and DPoP-Nonce value to accomplish this.
https://datatracker.ietf.org/doc/html/rfc9449#section-9

The guide should be updated to differentiate between the two.