Handle Negotiate proxy authentication

[durck]

Summary

Handle proxies that advertise Proxy-Authenticate: Negotiate without also advertising NTLM.

Details

• Classifies advertised proxy authentication schemes from a 407 response.
• Keeps explicit NTLM credentials as the preferred path when NTLM is offered.
• Allows host Kerberos/SSPI authentication for either Negotiate or NTLM offers when enabled.

Validation

• go test ./internal/client