fix(mpp): reject invalid credential header names

[mehmetkr-31]

Problem

WithHeader normalizes the implicit Authorization default but does not validate custom HTTP field names. As a result, both NewChallengeWithError and GenerateChallengeIDWithError accept values such as "Payment Authorization" and bind them into a challenge ID. ToAuthenticateStrict also serializes the value, even though this SDK's own ParseChallenge rejects the resulting challenge as an invalid HTTP header name.

That leaves the public challenge APIs able to produce an HMAC-bound challenge that cannot complete a serialize/parse round trip.

Fix

• Reuse the existing advertised-header parser in GenerateChallengeIDWithError, which also covers NewChallengeWithError.
• Apply the same validation in strict challenge formatting so manually constructed Challenge values fail closed.
• Add regression coverage for challenge creation, direct ID generation, and strict formatting.

The lenient FormatAuthenticate behavior is unchanged.

Cross-SDK check

• Canonical mppx validates Challenge.header with the HTTP token regex in Challenge.Schema.
• pympp validates the same field from Challenge.__post_init__ through advertised_credential_header.
• mpp-rs does not yet expose the credential-header parameter, so it has no corresponding input surface.
• mpp-go already applied this validation while parsing; this change closes the creation/formatting side of that internal mismatch.

Testing

The new creation and ID tests fail on main and pass with this change.

• go mod verify
• formatting check with gofmt -l .
• go vet ./...
• go build ./examples/...
• go test -race -count=1 ./...

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.