Note allowing restrictions on auth definition expressions

This allows implementors to impose restrictions on expression support for auth definition without affecting their compliance to the standard.

Many thanks for submitting your Pull Request :heart:!

Please specify parts of this PR update:

• [x] Specification
• [ ] Schema
• [ ] Examples
• [ ] Extensions
• [ ] Roadmap
• [ ] Use Cases
• [ ] Community
• [ ] TCK
• [ ] Other

Discussion or Issue link:

https://github.com/serverlessworkflow/specification/issues/668 What this PR does / why we need it:

Special notes for reviewers:

Additional information: