SEP-985: Align OAuth 2.0 Protected Resource Metadata with RFC 9728

[findleyr]

Ensure we're consistent with SEP-985.

[findleyr]

I believe this is implemented by #643.

[jba]

To implement this, we should:

• clarify the doc on auth.RequireBearerTokenOptions.ResourceMetadataURL to make it clear that it's optional if the server servers PRM at the well-known URL.
• similarly clarify the doc on auth.RequireBearerToken
• (probably) modify oauthex.GetProtectedResourceMetadataFromHeader to try the well-known URL if there is no header, for convenience. (The user could do this too.) At that point the function name is wrong, but it's not worth a breaking change to fix it.