InvalidTokenError.__init__ used **extra_attributes, so passing a dict via extra_attributes={"foo": "bar"} (which is done everywhere) wrapped it as {"extra_attributes": {"foo": "bar"} instead of using the dict directly. The WWW-Authenticate header then contained extra_attributes="{'foo': 'bar'}" instead of foo="bar".

Changed the parameter to extra_attributes=None to accept the dict directly.

Checklist

• The commits follow the conventional commits specification.
• You ran the linters with prek.
• You wrote unit test to demonstrate the bug you are fixing, or to stress the feature you are bringing.
• You reached 100% of code coverage on the code you edited, without abusive use of pragma: no cover
• You consent that the copyright of your pull request source code belongs to Authlib's author.