fix(parsing): reject malformed auth params

[EfeDurmaz16]

Summary

Reject malformed WWW-Authenticate: Payment auth-param lists instead of silently accepting partial regex matches.

This catches cases where required params are present but the header is still malformed, for example:

• missing comma separators between auth params
• trailing non-param junk after an otherwise valid challenge

Why

The parser previously used scan, so malformed text between or after matched params could be ignored. For payment challenges, accepting a partially parsed header can hide producer bugs and make interop failures harder to diagnose.

Verification

• mise exec ruby@3.3 -- bundle exec ruby -Itest test/mpp/test_parsing.rb
• mise exec ruby@3.3 -- bundle exec rake test
• mise exec ruby@3.3 -- bundle exec standardrb lib/mpp/parsing.rb test/mpp/test_parsing.rb
• git diff --check