Handle Negotiate proxy authentication

[durck]

Summary

Handle proxies that advertise Proxy-Authenticate: Negotiate without also advertising NTLM.

Details

• Classifies advertised proxy authentication schemes from a 407 response.
• Keeps explicit NTLM credentials as the preferred path when NTLM is offered.
• Allows host Kerberos/SSPI authentication for either Negotiate or NTLM offers when enabled.

Validation

• go test ./internal/client

[NHAS]

Hey this just looks good all round. I dont have good familiarity with this protocol however, so if you could just tell me how you've tested it I'll mark it as approved :)