Return `access_denied` error when an OAuth2 request is denied

[Zettat123]

According to RFC 6749, when the resource owner or authorization server denied an request, an access_denied error should be returned. But currently in this case Gitea does not return any error.

For example, if the user clicks "Cancel" here, an access_denied error should be returned.