fix: cap payment challenge request parsing

[brendanjryan]

Summary

• Reject WWW-Authenticate request parameters above the 16 KiB parser cap before later decoding.
• Added a parser regression test for oversized challenge request parameters.

Motivation

Aligns the Java SDK with the request-size hardening in tempoxyz/mpp-tools#35 so oversized challenge parameters fail early.

Key design considerations

• Reuses the existing Parsing.MAX_PAYLOAD_SIZE limit.
• Leaves normal parsing behavior unchanged for missing or in-limit request parameters.