onUnauthorized
Handles OAuth 2.0 errors such as authorization errors and token exchange failures.
If the handler does not complete the call, authentication continues through the default challenge handling.
In a session flow it also covers OAuth2SessionsConfig.sessionCreator or TypedSessionAuthConfig.validate returning null, but not exceptions they throw: those propagate to the routing pipeline.