auth: advertise RFC 6750 error code in WWW-Authenticate challenge

[PratikDhanave]

Summary

RequireBearerToken never added an error= auth-param to the WWW-Authenticate header it emits. On insufficient scope it returned 403 with resource_metadata/scope but no error="insufficient_scope".

The SDK's own client gates step-up re-authorization on exactly that value (AuthorizationCodeHandler.Authorize):

if resp.StatusCode == http.StatusForbidden && errorFromChallenges(wwwChallenges) != "insufficient_scope" {
    return nil // skip step-up
}

errorFromChallenges reads Params["error"]; since the server never set it, it returned "", the condition was true, and step-up never fired. A client hitting an SDK-based server that needs additional scopes just kept failing with 403 instead of upgrading scopes. It's also an RFC 6750 §3.1 deviation.

Fixes #1134

Change

Thread the RFC 6750 error code out of verify and add the error= auth-param to the challenge:

Failure	code	error=
insufficient scope	403	insufficient_scope
invalid / expired / missing-exp token	401	invalid_token
ErrOAuth	400	invalid_request
no token (no credentials)	401	(none — per RFC 6750)
5xx	500	(none)

The change only adds a param to the header — it is non-breaking.

Testing

• Extended TestVerify to assert the error code returned for each failure path.
• Added TestRequireBearerTokenAdvertisesInsufficientScope, which drives the middleware end-to-end and parses the emitted header with the same oauthex.ParseWWWAuthenticate the client uses, asserting error="insufficient_scope" is visible.
• Updated TestRequireBearerToken's expected WWW-Authenticate headers to include the new code.
• Verified the interop test fails without the fix (error param = "", want "insufficient_scope") and passes with it. go vet ./auth/ and the full go test ./auth/ suite pass.