fix: prevent panic in extractSubject for malformed bearer Authorization header

[ashnaaseth2325-oss]

Description

Summary

This PR fixes a potential index out of bounds panic in extractSubject when the Authorization header contains a bearer scheme without a token. It adds a defensive length check and a corresponding test case in handlers_test.go.

---

Fix

// BEFORE
parts := strings.SplitN(authzHeader, " ", 2)
if !strings.EqualFold(parts[0], "bearer") {
    return ""
}
_, _, _ = jwt.NewParser().ParseUnverified(parts[1], &claims)


// AFTER
parts := strings.SplitN(authzHeader, " ", 2)
if !strings.EqualFold(parts[0], "bearer") {
    return ""
}
if len(parts) < 2 {
    return ""
}
_, _, _ = jwt.NewParser().ParseUnverified(parts[1], &claims)

---

Verification

All unit tests pass locally with go test ./internal/mcpproxy/..., including the newly added case for Authorization: bearer. The change was also validated by confirming that malformed headers are handled gracefully without causing a panic.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.38%. Comparing base (7cf2c44) to head (d43c7d1).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2053   +/-   ##
=======================================
  Coverage   84.38%   84.38%           
=======================================
  Files         130      130           
  Lines       18114    18116    +2     
=======================================
+ Hits        15285    15287    +2     
  Misses       1883     1883           
  Partials      946      946           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ashnaaseth2325-oss]

Hello @nacx
This PR adds a small guard to handle Authorization: bearer safely and prevent a panic in extractSubject. It also includes a test for this case. All tests pass locally, happy to make any changes if needed!