chore: simplify auth challenge parser and Digest qop helper

[OmarAlJarrah]

Summary

Behavior-preserving simplifications in sdk-core's http/auth package, confined to two files and entirely to private members — no public-API movement, so apiCheck is unaffected. The existing AuthChallengeParserTest / DigestChallengeHandlerTest suites exercise these paths.

Changes

AuthChallengeParser.kt

• recoverToNextChallenge reuses readQuotedString(). The recovery loop carried a second, near-identical quoted-string skip that had to stay byte-for-byte in step with readQuotedString() — same opening-quote skip, same \-escape handling, same run-to-EOF on an unterminated string, same landing one past the closing quote. Calling the existing reader (and discarding the result) keeps that logic in one place. This is the error-recovery (cold) path, so the reader's discarded StringBuilder is a non-issue.
• Hoist the token68 rewind into a local helper. The "rewind to the saved position, read a token68, yield \"token68\" to …" sequence was repeated across all three disambiguation branches. A local function closing over saved/cursor states it once.
• Back the token / token68 character sets with String constants instead of Set<Char>. isTokenChar/isToken68Char run once per input character; against a String the same c in … test compiles to CharSequence.contains — a direct scan of a ≤14-char literal — removing the per-character Char boxing and HashSet lookup on the hot parse path, plus the one-time set allocation.

DigestChallengeHandler.kt

• Collapse qopSupportsAuth to a single expression. The accumulate-and-return loop is exactly any { … } with the same short-circuiting; the legacy null (qop-absent) guard is kept.

Verification

I traced the recovery-loop edge cases (normal string, escaped inner quote, unterminated string, dangling trailing backslash) to confirm readQuotedString() lands the cursor at the identical position the old hand-rolled skip did. Locally: :sdk-core:test (auth suites), compileKotlin (with allWarningsAsErrors), ktlint, detekt, and apiCheck all pass.

Closes #170