Normalize bearer token header format

[patvice]

This PR updates token header formatting to always use canonical Bearer for bearer tokens, while preserving other token types.

In auth.rb:

• Token#to_header now normalizes token_type so empty or case-insensitive "bearer" becomes "Bearer".
• Non-bearer token types (for example DPoP) are unchanged.

Added token_spec.rb with coverage for:

• default bearer formatting,
• lowercase "bearer" normalization to "Bearer",
• preserving non-bearer token types.
• This makes auth headers consistent with the standard Bearer scheme without changing behavior for other schemes.

closes #126