Clarify choice of new grants for strong auth use cases

The spec targets two use-cases:

> step-up authentication and transaction confirmation

If I understand correctly, the two new grant types

* http://auth0.com/oauth/grant-type/mfa-otp and
* http://auth0.com/oauth/grant-type/mfa-oob

can be used for both, authentication as well as transaction confirmation. Apparently the idea is that the two grants are for two different means of strong authentication: devices (hardware or software) which generate OTPs - as opposed to out-of-band authenticators (I take that to mean something like mobile tan or qr-code tan).

When the client receives the mfa_required error code with the mfa_token from the token endpoint, how does it decide which grant_type to use?

Start with the draft sections defining the mfa-otp and mfa-oob grant types, then trace the token endpoint flow that returns mfa_required and mfa_token. Clarify how clients choose between the grants for step-up authentication and transaction confirmation, and update the specification so the intended choice is unambiguous.

Written by the indexing model from the issue text.