Two standard endpoints for PAR

[janakamarasena]

I have some concerns with the authorization_challenge_endpoint being able to act as the PAR endpoint. I understand the improved experience gained here but this essentially creates two standard endpoints that can do similar things. Instead it might be possible to use the auth_session to maintain the complete context. However this could be overloading the expectations of the auth_session.