fix: reject stray trailing token after a valid auth-param in AuthChallengeParser

[OmarAlJarrah]

Problem

AuthChallengeParser accepted a malformed WWW-Authenticate / Proxy-Authenticate
value of the shape Scheme key=value <token> — a bare token directly following an
otherwise valid auth-param with no separating comma, e.g. Bearer realm="x" garbage.

The continuation loop kept the param list open only while the next non-whitespace
character was a comma, so when it hit the stray token it broke out and left the cursor
parked on that token. The top-level parse loop then read the stray token as the scheme
of a phantom second challenge. As a result Digest realm=value extra parsed into two
challenges (digest with realm=value, plus a bare extra) instead of being treated as
a single malformed challenge.

Change

RFC 7235 §2.1 permits only a comma (introducing another auth-param or the next challenge)
or end-of-input after an auth-param; a bare token in that position has no grammar
production. When the continuation loop now sees a non-comma, non-EOF character after a
valid auth-param, it skips the malformed tail to the next top-level comma via
recoverToNextChallenge and emits the challenge with the params parsed before the
garbage. This:

• stops the stray token from being misread as a phantom second challenge's scheme on the
  next outer iteration, and
• keeps the previously-parsed params, consistent with the parser's existing lenient
  recovery on malformed continuations.

Tests

• Digest realm=value extra (unquoted) — one challenge, realm=value, no phantom extra scheme.
• Digest realm="value" extra (quoted) — same.
• Digest realm=value extra, Basic realm="x" — the stray token is skipped to the next
  comma and the following Basic challenge is still parsed.

Build

Ran (scoped to the touched module):

./gradlew :sdk-core:test :sdk-core:ktlintCheck :sdk-core:detekt :sdk-core:apiCheck --no-daemon

BUILD SUCCESSFUL. No public-API change, so apiCheck passes against the committed
.api snapshot with no apiDump needed.

Closes #111. Replaces #142, which targeted the old http.auth package path since
relocated to auth.