Sample Code where an extended agent card is only returned when a user is actually authenticated

### Is your feature request related to a problem? Please describe.

The `helloworld` python agent example shows how to configure an extended agent card, and the `test_client.py` script shows how to add a dummy auth token to the request for an extended agent card, but the extended card is returned whether or not the auth token is present in the request, and whether or not the token is a valid token.

Is there an example where an a2a server only serves the extended card for actual authenticated users?

`test_client.py`

https://github.com/a2aproject/a2a-samples/blob/883c8906a60cb48e43599db0480d2217bd02c320/samples/python/agents/helloworld/test_client.py#L63-L69

a2a server code that serves both versions of the agent card regardless of the user's authentication status:

https://github.com/a2aproject/a2a-samples/blob/883c8906a60cb48e43599db0480d2217bd02c320/samples/python/agents/helloworld/__main__.py#L71-L75

### Describe the solution you'd like

I would like sample code that demonstrates how to restrict the extended agent card to only authenticated users.

### Describe alternatives you've considered

_No response_

### Additional context

_No response_

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Look at the a2a server code in samples/python/agents/helloworld/__main__.py lines 71-75 and the test_client.py script. The issue is to modify the server to check the auth token before returning the extended agent card. Start by understanding how authentication is handled in the a2a protocol, then implement a check in the server's card-serving logic. Verify by running the test client with and without a valid token.

Escrita pelo modelo de indexação a partir do texto da issue.