Expand differences from OAuth 2.0 section 10

[aaronpk]

Document each change and when there is a breaking change note for which role it breaks.

e.g.

A 2.1 client trying to work with a 2.0 server that uses PKCE would break if the redirect_uri is not sent to the token endpoint if the client is configured with more than one redirect_uri.