The RFC 6750 guard in `_SUPPORT_BEARER_RE` kept any `<letters>="` after
Bearer as an auth-param, so `Bearer qwertyuiopas="v"` (and UPPER/Capitalised
or 20+ letter runs) reached the support upload whole; the merge base scrubbed
it. Found by the REDACT2 fold5 leak table (`="v"` tail), which must show zero
head-only leaks.
Keep only the named challenge params (realm, scope, error,
error_description, error_uri): `Bearer realm="api"` still stays, anything
else key-shaped is scrubbed (fail closed).
48975fcaa2