Function error_response_with_headers 

pub fn error_response_with_headers(
    status: StatusCode,
    id: Option<Value>,
    code: i32,
    message: impl Into<String>,
    extra_headers: &[(&str, String)],
) -> Response

error_response with optional response headers (e.g. WWW-Authenticate, Retry-After). SP-token-broker-phase2 §4.4 requires distinct headers for each bearer-auth error class so adopter-side UIs can distinguish “expired” / “revoked” / “unknown” without re-parsing the message body.