Return WWW-Authenticate header with 401 responses as OAuth2 spec says

## Return WWW-Authenticate header with 401 responses

Looks like it can just say: `WWW-Authenticate: Bearer`

### Acceptance Criteria
1. If the user makes a request for a protected resource without including an `Authorization` header in the format `Bearer [token_goes_here]`, the OAuth2Listener returns 400 with `WWW-Authenticate: Bearer error="invalid_request"` header.
1. If the user makes a request for a protected resource with an invalid or expired token, the OAuth2Listener (or OAuth2OptionalListener) returns 401 with `WWW-Authenticate: Bearer error="invalid_token"` header.

### Tasks
- Update Synapse\Security\Firewall\OAuth2Listener::getForbiddenResponse()

### Additional Notes
- ~~http://self-issued.info/docs/draft-ietf-oauth-v2-bearer.html#authn-header~~ Never mind, that is a draft.
- [The real OAuth2 Spec](https://tools.ietf.org/html/rfc6749)
- The related spec: [OAuth 2 Authorization Framework: Bearer Token Usage](https://tools.ietf.org/html/rfc6750#section-3). (See section 3 and specifically 3.1)