A server could reply with an Authentication-Info header carrying a
cnonce but no rspauth, which was passed to strcmp() as NULL. Treat a
missing rspauth as an authentication failure, and do not compare the
cnonce against a client nonce that was never generated.
Fixes#30043
