Bounded RFC 9110 challenge parser specialized for MCP Bearer challenges.
Multiple WWW-Authenticate field lines are combined as one list. Other
schemes are ignored after syntactic segmentation, while zero or one Bearer
challenge is accepted. Bearer parameter names are case-insensitive and
duplicate names or multiple Bearer challenges fail closed.