oauthex: ParseWWWAuthenticate takes quadratic time on long headers #1455

Describe the bug

oauthex.ParseWWWAuthenticate takes time quadratic in the length of the header. splitChallenges looks ahead from every comma to decide whether it separates challenges or auth-params, and that lookahead trims and scans the rest of the header each time.

AuthorizationCodeHandler.Authorize and ClientCredentialsHandler.Authorize call it as their first step on a 401/403 response. It takes no context, so a client timeout does not interrupt it.

To Reproduce

package main

import (
	"fmt"
	"strings"
	"time"

	"github.com/modelcontextprotocol/go-sdk/oauthex"
)

func main() {
	for _, n := range []int{25_000, 50_000, 100_000} {
		h := "Bearer " + strings.Repeat(",", n)
		start := time.Now()
		_, err := oauthex.ParseWWWAuthenticate([]string{h})
		fmt.Println(len(h), err, time.Since(start))
	}
}

On main (2e00768), measured locally:

Other shapes are also slow, e.g. A,A,A,...,A=1 (500 KB: 170 s) and challenges without params (A, A, A, ..., 1 MB: 6 s).

v1.8.0 has the same quadratic behavior with a much smaller constant (800 KB of commas: 11 s). It got about 28x slower on main with #1351 (empty list elements), which added the per-comma trim.

Expected behavior

Parse time grows linearly with the header length, and the result is unchanged. Headers from a misbehaving server or proxy should not be able to stall a client for minutes.

Additional context

I have a fix that computes the lookahead once per run of commas and reads only the next token, plus a regression test. I'll open a PR for it. One behavior change to flag: a comma inside the name before the =, as in Bearer x, a,b=c, ends the challenge. A token cannot contain a comma (RFC 9110, section 5.6.2); today a,b is treated as a parameter name.