fix: align Stripe and parser conformance behavior

[emmajam]

Summary

• bind Stripe externalId in the server challenge request and reject forged credential-only values
• serialize Stripe request details as paymentMethodTypes and pass that allowlist through to PaymentIntent creation
• emit Payment-Receipt externalId while keeping legacy external_id parse support
• move parser validation into the SDK for duplicate auth params, invalid base64url payloads, invalid method IDs, non-string method IDs, and merged WWW-Authenticate challenges