Clarify how OAuth extension specifications affect authorization request parameter requirements

OID4VP should clarify how OAuth extension specifications influence the requirements for authorization request parameters.

For example, an OAuth Authorization Request normally requires the response_type parameter. However, when using JWT Secured Authorization Requests (JAR), JAR states that the parameters contained in the Request Object are authoritative, meaning that parameters outside the Request Object are ignored for processing. Also note that as per JAR, response_type is optional and no longer mandatory in the initial request.

Without an explicit statement, this can create ambiguity as to whether parameters such as response_type are always required at the HTTP request level, or whether the requirements defined by OAuth extension specifications (such as JAR) take precedence.

Proposal:

Add a general statement that OAuth parameters defined outside of this specification must be used according to the applicable OAuth core and extension specifications.

This would make it clear that, for example, when JAR is used, the rules defined by JAR regarding Request Object processing take precedence over the generic OAuth Authorization Request parameter requirements, avoiding ambiguities around parameters such as response_type.

Start with the OID4VP text defining authorization request parameters, then compare its requirements with the OAuth core and JAR rules described in the issue. Add a general statement explaining that applicable OAuth extension specifications govern parameters defined outside OID4VP, and verify that the response_type example is no longer ambiguous.