More precise error message on COSE msg type mismatch

[achamayou]

    This error is very vague, and repeated in multiple places. I think they should mention that this is an issue with COSE signing, the name of the protected header it doesn't like, and the value it was expecting there.

That can be done in a follow-up though, not a blocker here.

(We could also push this check, and the one above about active members, into the auth policy itself? ie have multiple instances of the auth policy, and have an auth policy for this endpoint that checks this value of the protected header too? The advantage is moving more of the auth-like checks to the same place, with consistent error reporting. Downside is a massive increase in the number of auth policy instances if we make them too specific. Don't know where the right balance is there)

Originally posted by @eddyashton in #4392 (comment)