changeset: state the challenge-header sanitization instead of claiming unchanged behavior

Author: felixweinberger

.changeset/web-standard-bearer-auth.md

@@ -9,5 +9,7 @@ Add runtime-neutral Bearer authentication to `@modelcontextprotocol/server`:
 Workers, Deno, Bun, Hono), built on the exported `verifyBearerToken` and
 `bearerAuthChallengeResponse` pieces, with `OAuthTokenVerifier` now defined
 here. The Express middleware adapts the same core and is unchanged in
-behavior; `@modelcontextprotocol/express` re-exports `OAuthTokenVerifier` as
-before.
+behavior, except that `WWW-Authenticate` challenge values are now RFC 7235
+quoted-string sanitized (quotes and backslashes escaped, control and
+non-ASCII characters replaced); `@modelcontextprotocol/express` re-exports
+`OAuthTokenVerifier` as before.