Add support for resource_metadata in the WWW-Authenticate header

[pusewicz]

As per https://datatracker.ietf.org/doc/rfc9728/

This specification introduces a new parameter in the WWW-Authenticate HTTP response header field to indicate the protected resource metadata URL:

resource_metadata:
The URL of the protected resource metadata.

The response below is an example of a WWW-Authenticate header that includes the resource identifier.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata=
  "https://resource.example.com/.well-known/oauth-protected-resource"

The HTTP status code in the example response above is defined by [RFC6750].

This parameter MAY also be used in WWW-Authenticate responses using authorization schemes other than "Bearer" [RFC6750], such as the DPoP scheme defined by [RFC9449].

The resource_metadata parameter MAY be combined with other parameters defined in other extensions, such as the max_age parameter defined by [RFC9470].

[pusewicz]

@nov I'd love to add support for this particular parameter when responding with the WWW-Authenticate header, and this seems to be the best place to add it. Would love your review, thanks!