Handling of `state` parameter in Authentication: Update spec so clients are required to send `state` parameter

[GeorgDangl]

For the next major version, clients are required to send the state parameter. But servers are not required to fail a request that misses it.

See also #40.

[ykulbak]

Sep 25th 2023. See comment from the same date. on #25