fix(mpp): match auth-param names case-insensitively

[memosr]

parseAuthParams keys the params map on the raw name token, so RFC 9110 §11.2 — which its own doc comment cites — is never applied:

Authentication parameters are name/value pairs, where the name token is matched case-insensitively, and each parameter name MUST only occur once per challenge.

Two consequences:

• A fully valid mixed-case challenge is rejected with missing required challenge fields.
• A duplicate hidden by case slips past the duplicate guard. Payment id="a", ID="b", ... parses and silently yields a, while a peer that normalizes names reads b.

The asymmetry sits inside one function: ParseChallenge already applies §11.1 with strings.EqualFold(scheme, "Payment"), then hands the rest to a parser that compares names byte for byte. The conformance suite pins both halves of the rule, case_insensitive_scheme for the scheme and error_duplicate_parameters for duplicate names; mpp-go passes both literally while the duplicate guard stays bypassable.

Only the name token is lowercased. Values are left verbatim so challenge IDs and base64url payloads keep their case, and uppercase method value is still rejected guards that boundary: lowercasing the whole pair would turn METHOD="Tempo" into a valid method name.

Written test first. Seven of the eight subtests fail against the current parser; duplicate name in the same case is still rejected passes before and after as a regression guard.