Add support for error headers in auth callout handlers

[istvan-andrasi]

Proposed change

Check for service error headers before trying to decode the auth callout response.

Use case

• Currently there is no way to provide a reason when encoding or encrypting the AuthorizationResponseClaims fails, since it is expected to be supplied in the error field of the jwt which we couldn't encode or encrypt.
• Support for the error headers in the reply make it easier to implement the auth callout handler as service. (e.g. using early replies and returns without creating the response jwt)

Contribution

PR ready for review: #7500

[istvan-andrasi]

Discussion happens in the PR, sorry for creating an unnecessary issue.