fix(oauth): Use unauthorized_client for unregistered grant types

The token endpoint already refused grant types the client had not
registered, but reported it as `invalid_grant`. RFC 6749 section 5.2
reserves `invalid_grant` for an authorization grant which is "invalid,
expired, revoked, does not match the redirection URI used in the
authorization request, or was issued to another client", and defines
`unauthorized_client` for a client which "is not authorized to use this
authorization grant type".

Report the condition with the error code the specification assigns to it,
matching the device authorization endpoint.

changelog.d/2110.bugfix.md

@@ -1 +1 @@
-The OAuth 2.0 device authorization endpoint now rejects clients which did not register the device code grant type, instead of issuing them a device code. Contributed by @mmaudet.
+The OAuth 2.0 device authorization endpoint now rejects clients which did not register the device code grant type, instead of issuing them a device code. The token endpoint now returns the `unauthorized_client` error code when a client requests a grant type it did not register, instead of `invalid_grant`. Contributed by @mmaudet.

src/service/oauth/mod.rs

@@ -442,7 +442,7 @@ pub async fn issue_token(&self, request: TokenRequest) -> Result<TokenResponse,
 		};
 
 		if !client_metadata.grant_types.contains(&request.grant_type()) {
-			return Err(OAuthError::invalid_grant("Client cannot request this grant type"));
+			return Err(OAuthError::unauthorized_client("Client cannot request this grant type"));
 		}
 
 		match request {