feat: add the auth.www-authenticate features

[tobixen]

This is partly a response to #713 - together with the similar pull request in the caldav-server-tester library we can now probe servers to see if they give away the www-authenticate-header or not.

Commit message:

RFC7235 section 3.1 requires a 401 to name an authentication scheme, and a server that omits it - or names only schemes this library cannot use - leaves nothing to negotiate: the password is never transmitted and the bare 401 surfaces as an AuthorizationError indistinguishable from a rejected one.  The two features record which of the two it is, so the auth_type such a server needs is documented rather than folklore.  Probed by caldav-server-tester's CheckWWWAuthenticate.

The grouping node derives nothing from its children, since _derive_from_subfeatures skips a child with its own default; six nodes have that shape, so it is filed rather than worked around.

Prompt: https://github.com/python-caldav/caldav/issues/713 - please create a check [in the caldav-server-tester project] for this (server expecting basic auth, but not yielding any WWW-Authenticate-header)
Followup-Prompt: (comment from the review process) I thought Google used Bearer and not Basic?  Meaning that the solution "slap Basic if no auth_scheme given" will fail?
Followup-Prompt: (comment from the review process - clarifying that a "documentation issue" found was actually a code bug)  a _parent_ that carries it's own default should not derive from the children.  However, a parent without a default (and without a check) should always derive from it's children (certainly including _real_ child features - those that do have a check and an explicit default value).  If it's a bug, then it should be filed.

Assisted-By: Claude Opus 5 <noreply@anthropic.com>
Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>