auth: use Bearer challenges for resource metadata

[jay23606]

resourceMetadataURLFromChallenges currently accepts resource_metadata from any authentication scheme. When a Basic challenge precedes a Bearer challenge, metadata discovery can select the Basic URL. Restrict both authorization handlers to the Bearer challenge and add regression coverage for each helper.

Validation:

• go test ./auth ./auth/extauth — passed.
• Regression gate against clean main — both test runs failed as expected; both runs on the fix passed.
• go vet ./..., go build ./..., and git diff --check — passed.
• go test ./... has a pre-existing Windows failure in mcp/TestServerConformance/resources.txtar: the fixture expects LF while Windows produces CRLF. The same failure occurs on clean main.

Fixes #1379

[guglielmo-san]

this represent a behavioral change for existing users that were relying on the basic auth for example.
We should implement a preference for "bearer" with fallback to any other scheme defined

var fallback string
for _, c := range cs {
	u := c.Params["resource_metadata"]
	if u == "" {
		continue
	}
	if c.Scheme == "bearer" {
		return u
	}
	if fallback == "" {
		fallback = u
	}
}
return fallback