Protected resource metadata

Also written: RFC 9728

A JSON document naming the authorization server and scopes a server uses. A 401 response's `WWW-Authenticate` header points clients to it.