More explicit subject creation validation

[blootsvoets]

There are three things about the user creation validation that are not completely right

• A bad request should give HTTP Status 400 (bad request, syntax or properties don't match) or 422 (Unprocessable Entity, syntax and properties are correct, but the command cannot be processed anyway), not 417 (Expectation Failed), which is specifically meant for the Expect HTTP header not matching. https://github.com/RADAR-base/RADAR-Rest-Source-Auth/blob/d1e035001c7ea24ded3decefcaa948da1e463567/src/main/java/org/radarbase/authorizer/validation/exception/ValidationFailedException.java#L7
• The validation of a request should give a reason in the response, not just state that the request was not valid.
• The frontend should show this reason, and not just keep the page exactly as it was, like no request happened.