InvalidClientError should return 401

[Uzlopak]

https://datatracker.ietf.org/doc/html/rfc6749#section-5.2

 Client authentication failed (e.g., unknown client, no
               client authentication included, or unsupported
               authentication method).  The authorization server MAY
               return an HTTP 401 (Unauthorized) status code to indicate
               which HTTP authentication schemes are supported.  If the
               client attempted to authenticate via the "Authorization"
               request header field, the authorization server MUST
               respond with an HTTP 401 (Unauthorized) status code and
               include the "WWW-Authenticate" response header field
               matching the authentication scheme used by the client.

[jankapunkt]

@Uzlopak which lines and which tests are affected by this? We need to update tests for this, too!

[jorenvandeweyer]

I checked al InvalidClientError errors. None MUST throw a 401 error from the spec since this error is not used when an authorization header is being validated.