#3041 Fix substring matches in WWW-Authenticate parsing

Fixes #3009.

extract_field_from_www_auth currently matches field_name as a substring of another auth-param name, so fields like scope can be shadowed by error_scope and resource_metadata can be shadowed by x_resource_metadata.

This change parses comma-delimited auth parameters without splitting quoted values, preserves the generic helper's support for non-Bearer schemes, and scopes the RFC-specific scope and resource_metadata helpers to the first Bearer challenge. It also handles quoted-pair escapes and optional whitespace around =.

Tested with:

• uv run --frozen pytest tests/client/test_auth.py -q (143 passed, 1 xfailed)
• targeted branch coverage for src/mcp/client/auth/utils.py (100% statements and branches)
• uv run --frozen ruff check src/mcp/client/auth/utils.py tests/client/test_auth.py
• uv run --frozen ruff format --check src/mcp/client/auth/utils.py tests/client/test_auth.py
• uv run --frozen pyright src/mcp/client/auth/utils.py tests/client/test_auth.py

AI assistance was used for parser edge-case analysis and test review; I reviewed and validated the resulting changes.