pkg/tcp: support SHA-256 / SHA-512-256 RTSP Digest auth (RFC 7616)

[pkmanivannan]

Problem

go2rtc's RTSP Digest auth (pkg/tcp/auth.go) is hardcoded to MD5. Some IP
cameras — notably Hikvision-OEM firmware (e.g. Prama PT-NC143D3-WNM, firmware
V5.8.5) and hardened / STQC-certified units — offer only SHA-256 Digest for
RTSP, with no MD5 or Basic option in the web UI:

WWW-Authenticate: Digest realm="IP Camera(GH455)", nonce="...", algorithm="SHA-256", stale="FALSE"

Against these cameras go2rtc returns 401 Unauthorized and the stream never
connects. FFmpeg is also MD5-only, so the usual ffmpeg: source fallback does
not help either.

Change

Select the digest hash from the challenge's algorithm= token per RFC 7616:

• MD5 / absent → MD5 — unchanged; the Authorization header is byte-for-byte
  identical to before, so existing cameras are unaffected.
• SHA-256 → SHA-256
• SHA-512-256 → SHA-512-256

For non-MD5 algorithms the token is echoed back as algorithm="…" in the
Authorization header (some firmware validates it); MD5 keeps the original format
with no algorithm=. This is the no-qop Digest path already used by
pkg/tcp/auth.go.

Testing

• New pkg/tcp/auth_test.go drives Read() → Write() for MD5, SHA-256 and
  SHA-512-256 and asserts the exact response= against vectors computed
  independently (Python hashlib). All pass.
• Field-tested end to end: a build with this patch authenticates to a real
  SHA-256-only Hikvision-OEM camera and restreams it into Frigate, where stock
  go2rtc and FFmpeg both fail with 401.

Scope / note

This covers the RTSP Digest path (pkg/tcp/auth.go). The HTTP client in
pkg/tcp/request.go (Do, used for ISAPI / snapshot) has the same MD5-only
limitation and could be extended with the same digestHash helper — happy to do
that in a follow-up if wanted. I kept this PR to the path I could verify against
hardware.