fix(mpp): decode \uXXXX escapes in challenge quoted-strings

[kriss39]

Problem

A header value cannot carry characters above Latin-1, so mppx escapes them as \uXXXX when it serializes a challenge and decodes them again when it parses one. readQuotedAuthParamValue treats the backslash as a plain RFC 9110 quoted-pair — drop the backslash, keep the next byte — so the escape survives as literal text.

Round-tripping a description through the reference implementation and then through mpp-go:

mppx emits  : description="Payment — 50% off ☕"
mppx parses : "Payment — 50% off ☕"
mpp-go parses: "Payment u2014 50% off u2615"

pympp and mpp-rs decode it the same wrong way; companion PRs are open for both.

Description is excluded from the challenge binding, so a corrupted one is cosmetic. The same escape is applied to every quoted parameter though, including realm, which is slot 0 of the challenge ID HMAC — a realm above Latin-1 would come back altered and the binding check would then fail.

Fix

Decode the escape, matching readQuotedAuthParamValue in mppx:

• \uXXXX becomes that code unit.
• Astral characters are serialized as a surrogate pair (😀 → 😀), so a high surrogate is combined with the escape that follows it via utf16.DecodeRune.
• An unpaired surrogate becomes U+FFFD, which is the closest value a Go string can hold.
• A doubled backslash is still consumed first, so \\u2014 stays the literal text — — the same reasoning the reference implementation documents for why a bare \u is unambiguous.

Only the parse side changes, and only the escape handling: raw bytes still go through WriteByte, so characters at or below Latin-1, which the serializer leaves unescaped, are unaffected. They are covered in the tests to pin that down.

Tests

Seven cases in TestParseChallengeDecodesUnicodeEscapes: BMP escapes, an astral surrogate pair, raw Latin-1, both unpaired surrogates, a doubled backslash, and a truncated escape. Four fail on main.

go test ./... and go vet ./... pass, gofmt is clean.

The expectations were taken from mppx rather than written by hand: the header shape in the tests is what Challenge.serialize produces, and each expected value is what Challenge.deserialize returns for it.

[kriss39]

Companion fixes for the same escape, so the three SDKs land on the reference behaviour together: tempoxyz/pympp#247 (Python), tempoxyz/mpp-rs#418 (Rust).

[brendanjryan]

Superseded by #168, which expands this Unicode fix to parsing and formatting with surrogate, malformed-escape, and round-trip coverage, and is covered by tempoxyz/mpp-tools#240. Thank you for identifying this.