client_secret_basic authentication failures should return challenge

As per section 3.2.3.1. Error Response:

"invalid_client": Client authentication failed (e.g., unknown
client, no client authentication included, or unsupported
authentication method). The authorization server MAY return an
HTTP 401 (Unauthorized) status code to indicate which HTTP
authentication schemes are supported. If the client attempted
to authenticate via the "Authorization" request header field,
the authorization server MUST respond with an HTTP 401
(Unauthorized) status code and include the "WWW-Authenticate"
response header field matching the authentication scheme used
by the client.

We should respond with the required authentication scheme when a client fails authentication.