Improve AuthorizationsController error response handling

[camero2734]

Summary

Hey, first time contributing, hope this is welcome

This PR has three changes to AuthorizationsController's error response, explained in more detail below:

• Returns the proper status code instead of 200
• Redirects back to the client with error (if redirectable?)
• Honors the raise_on_errors? setting

---

I noticed that Doorkeeper returns a 200 response code when an error occurs, and also does not redirect back to the client on errors as my understanding of the spec indicates it should:

https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1

Non-redirecting

If the request fails due to a missing, invalid, or mismatching
redirection URI, or if the client identifier is missing or invalid,
the authorization server SHOULD inform the resource owner of the
error and MUST NOT automatically redirect the user-agent to the
invalid redirection URI.

Redirecting

If the resource owner denies the access request or if the request
fails for reasons other than a missing or invalid redirection URI,
the authorization server informs the client by adding the following
parameters to the query component of the redirection URI using the
"application/x-www-form-urlencoded" format

There is already the concept of redirectable? in Doorkeeper which adheres to this, but it seems like this isn't actually used for errors in authorizations_controller.

The status code change is applied normally, but I feel like the redirection bit is probably a breaking change since it adds redirects where there wasn't any before, so I added it as a config option via handle_auth_errors :redirect

Fixes #1643

[nbulaj]

Basically I like it 👍

[nbulaj]

Also can you please add a changelog entry?

[camero2734]

Or maybe this should just be configured as handle_auth_errors :redirect?

[camero2734]

Yeah, I went ahead and did this since I think it makes more sense and it cleaner this way 👍

[nbulaj]

LGTM 👍

[camero2734]

Hey @nbulaj, any plans for when the next release will be? We'd like to be able to replace our local monkeypatch with this change. Happy to help out in any way to get it released!