Allow multiple spaces in bearer authorization header

[avsan]

Summary

Allow DefaultBearerTokenResolver to accept one or more spaces between
the Bearer authentication scheme and the token.

RFC 6750 permits one or more SP characters between Bearer and the
credentials, while the current pattern only accepts exactly one space.

Changes

• Update the bearer token pattern to accept one or more spaces.
• Add regression coverage for an Authorization header containing multiple
  spaces before the token.
• Preserve the existing behavior for valid single-space bearer headers.

Testing

• Added a focused regression test for multiple spaces.
• Existing DefaultBearerTokenResolverTests pass.
• git diff --check is clean.

Closes gh-19500