fix(client): handle merged payment challenges

[EfeDurmaz16]

Summary

• Parse merged WWW-Authenticate headers with Challenge.from_www_authenticate_list in the client transport.
• Keep skipping malformed or unsupported challenges, but continue looking for a supported payment method in the same header value.
• Add a client transport test where an unsupported challenge appears before a supported one in a merged header.

Why

• The parser already supports RFC-style comma-separated Payment challenges, but the client transport only tried to parse each header value as one challenge.
• Servers or proxies can combine multiple WWW-Authenticate values into one header, so the client should still find a supported MPP method.

Verification

• mise exec ruby@3.3.11 -- ruby -Ilib -Itest test/mpp/test_client.rb
• mise exec ruby@3.3.11 -- ruby -Ilib -Itest test/mpp/test_parsing.rb
• mise exec ruby@3.3.11 -- ruby -c lib/mpp/client/transport.rb
• mise exec ruby@3.3.11 -- ruby -c test/mpp/test_client.rb
• git diff --check

Notes

• I also tried the Bundler path with mise exec ruby@3.3.11 -- bundle exec rake test test/mpp/test_client.rb; local dependency installation is blocked by native rbsecp256k1 build prerequisites (aclocal/automake) on this machine, so I ran the focused tests directly with the repo lib and test load paths.