fix(session): match the Bearer scheme case-insensitively

[allen0099]

Closes #166.

Problem

The session middleware (FastAPICacheXSessionMiddleware and the deprecated SessionMiddleware, through _extract_header_token) read the bearer token with auth_header.startswith("Bearer "). Authentication scheme names are case-insensitive (RFC 9110 §11.1), so these headers got no session:

Authorization	before	after
Bearer tok	"tok"	"tok"
bearer tok / BEARER tok	None	"tok"
Bearer tok (two spaces, allowed by RFC 6750 §2.1)	" tok"	"tok"
Bearer	""	None

Change

• Split the header on the first space, and compare the scheme case-insensitively.
• Strip the extra spaces before the token.
• Return a token only when one is present. An empty bearer header now falls through to the next source in token_source_priority, as an empty custom header already does.

Tests

• New parametrized tests cover the scheme in several cases, extra spaces, and headers that are empty or use another scheme.
• Mutation check: with the fix reverted, exactly the five new cases that differ fail.
• middleware.py coverage stays at 100%.