Auth issues

@taleodor wrote in #261

Also some issues vs https://github.com/CycloneDX/transparency-exchange-api/pull/258 that would need to be addressed:

It says an expired token means new versions won't be accessed and should be surfaced to users. Under https://github.com/CycloneDX/transparency-exchange-api/pull/258 an expired access token is routine: 401 with error="invalid_token", fetch a new token, retry once. Only an expired API key is user-facing.
The error list omits the 401 Bearer challenge, which https://github.com/CycloneDX/transparency-exchange-api/pull/258 makes the signal that authentication is required.
"Validate TLS certificates" is a SHOULD here; https://github.com/CycloneDX/transparency-exchange-api/pull/258 says clients shall verify the server certificate.
The touched line "sometimes with an associated authentication token" should say API key.

Start by reading the specification text discussed in issue #275 and compare its authentication guidance with pull request #258 and the context from issue #261. Identify the sections containing the expired-token behavior, 401 Bearer challenge, TLS verification, and API key wording. Done means those four statements consistently reflect the referenced authentication behavior.

Written by the indexing model from the issue text.