Clarify in-task authorization scope in A2A spec

[muscariello]

We should improve clarity in the A2A specification about what is in scope for authorization semantics during in-task authorization.

Proposed clarification:

• TASK_STATE_AUTH_REQUIRED is a coordination signal, not an authorization grant by itself.
• A2A does not define credential scope, validity, or revocation semantics in core protocol text.
• Implementations must define how operation-level authorization is identified and verified before execution.

Goal: reduce ambiguity for implementers without expanding core protocol scope.

[mikeas1]

I agree with the points. Let's also make sure the language is clear that extensions can be used to cover some of these areas. (your PR does, just noting that's my ideal path for addressing these issues)