fix using use_attestation_challenge error parameter code for missing …

[mickrau]

solves #131

[panva]

Suggested change

	An error parameter according to Section 3 of {{RFC6750}} SHOULD be included to indicate why a request was declined. If the Client Attestation is not using an expected server-provided challenge, the value `use_attestation_challenge` can be used to indicate that an attestation with a server-provided challenge was expected. If the attestation and proof of possession was present but could not be successfully verified, the value `invalid_client_attestation` is used.
	When validation errors are encountered the following error codes are defined for use in either Authorization Server authenticated endpoint error responses or Resource Server error responses.
	- `use_attestation_challenge` MUST be used when the Client Attestation PoP JWT is not using an expected server-provided challenge. When used this error code MUST be accompanied by the `OAuth-Client-Attestation-Challenge` HTTP header field parameter (as described in [](#challenge-header)).
	- `invalid_client_attestation` MAY be used if the attestation or its proof of possession could not be successfully verified.

[panva]

And change

## Providing Challenges on Previous Responses

to

## Providing Challenges on Previous Responses {#challenge-header}

[panva]

I am making this suggestion because a) this section is referenced from Token and PAR endpoint sections and linking 6750 error handling is invalid.

Making use_attestation_challenge a MUST use when challenge validations fail just makes sense and having to have it accompanied by OAuth-Client-Attestation-Challenge as well. I don't mind defining invalid_client_attestation but only as a MAY because on the AS authenticated endpoints the convention is already invalid_client for client authentication failures.

[panva]

I've opened #135 as an alternative to this PR with all suggestions applied.

[tplooker]

Thanks @mickrau, although I'm in favour of #135 here which builds on this PR and provides a little more clarity around when these errors should be returned.