Part 2: Clarify that servers 'may' support the request object endpoint

I've had several queries as to whether request object endpoint support is required in the AS or not over the last few months. I don't think the current language is clear, so I have added an explicit clause to the authorisation server requirements sections.

Also a minor cleanup to remove the 'and' for this set of clauses to the correct place.