Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

spec: align error-response and field-validation rules with the implementation

Follow-up sync pass after the review remediation:

- Scope the WWW-Authenticate Bearer challenge to token-related failures
  (missing/invalid/insufficiently-scoped token); a 400 for a request malformed
  independently of the access token (missing topic, unknown matcher parameter)
  need not carry a challenge, matching RFC 6750's scope and the hub behavior.
- Reject all control characters (C0/C1/DEL) in the publish id and type fields,
  not only CR/LF/NUL, consistent with the topic and matcher rules and with the
  hub, since the id travels in the Last-Event-ID field.
- Note that clients must percent-encode reserved characters in matcher names and
  values (as URLSearchParams does), so the x-www-form-urlencoded parsing is
  unambiguous across implementations.