Sample Code where an extended agent card is only returned when a user is actually authenticated

### Is your feature request related to a problem? Please describe.

The `helloworld` python agent example shows how to configure an extended agent card, and the `test_client.py` script shows how to add a dummy auth token to the request for an extended agent card, but the extended card is returned whether or not the auth token is present in the request, and whether or not the token is a valid token.

Is there an example where an a2a server only serves the extended card for actual authenticated users?

`test_client.py`

https://github.com/a2aproject/a2a-samples/blob/883c8906a60cb48e43599db0480d2217bd02c320/samples/python/agents/helloworld/test_client.py#L63-L69

a2a server code that serves both versions of the agent card regardless of the user's authentication status:

https://github.com/a2aproject/a2a-samples/blob/883c8906a60cb48e43599db0480d2217bd02c320/samples/python/agents/helloworld/__main__.py#L71-L75

### Describe the solution you'd like

I would like sample code that demonstrates how to restrict the extended agent card to only authenticated users.

### Describe alternatives you've considered

_No response_

### Additional context

_No response_

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct