Because:
* RFC 9470 section 5 requires the authorization request to fail with
unmet_authentication_requirements when the requested authentication
level cannot be reached; FxA had no such path
* a prompt=none step-up routed the user to an interactive 2FA page,
which the parameter forbids, and the RP was never told
This commit:
* adds an UNMET_AUTHENTICATION_REQUIREMENTS oauth error carrying the
RFC error code, relayed by the authorization route's existing
getRedirectWithErrorUrl path
* fails prompt=none step-up requests instead of routing to a challenge,
for errno 170 only — an unverified session is interaction_required
* documents errno 170 and the step-up parameters on /oauth/authorization
* pins that the id_token acr claim reflects the achieved AAL
Closes #FXA-12860