fix: match WWW-Authenticate params exactly

[mturac]

Summary

• parse WWW-Authenticate auth-params outside quoted values before extracting a field
• require auth-param names to match exactly
• cover substring collisions and quoted-value false positives

Fixes #3009

Tests

• uv run --frozen pytest tests/client/test_auth.py -k 'extract_field_from_www_auth'
• uv run --frozen pytest tests/client/test_auth.py
• uv run --frozen ruff format --check src/mcp/client/auth/utils.py tests/client/test_auth.py
• uv run --frozen ruff check src/mcp/client/auth/utils.py tests/client/test_auth.py
• git diff --check
• uv run --frozen coverage run -m pytest tests/client/test_auth.py -k 'extract_field_from_www_auth' && uv run --frozen coverage combine && uv run --frozen strict-no-cover

[cubic-dev-ai]

1 issue found across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[mturac]

Addressed in da31061 by parsing auth-params with quote-aware comma splitting and adding regression coverage for quoted-value false positives.