Negative caching

[njwatson32]

The draft says:

The authorization server MUST NOT cache error responses.  The
authorization server also MUST NOT cache documents which are invalid
or malformed.

I think there need to be allowances for short-lived negative caching to avoid:

1. Spamming unrelated websites with calls (Client metadata retrieval can be abused to make server issued requests #30)
2. Exacerbating outages with repeated requests

Maybe leaving it a little vague is ok, something like:

The authorization server MUST NOT cache error responses or invalid documents for more than a few minutes.

[njwatson32]

Another thing to maybe add to a non-normative implementation notes section is to recommend that an AS not discard a cached (valid) CIMD until it successfully retrieves a new one from the client.