[Feat]: Auth header injection for testing authenticated A2A servers

### Is your feature request related to a problem? Please describe.

The TCK documents authentication configuration via environment variables (`A2A_AUTH_TYPE`, `A2A_AUTH_TOKEN`, `A2A_AUTH_HEADERS`) in `docs/AUTHENTICATION_SETUP.md`, but no transport client actually reads or injects these values. This means the TCK cannot test any A2A server that requires authentication — all `message/send`, `tasks/get`, `tasks/cancel` requests arrive without an `Authorization` header and get rejected with 401.

### Describe the solution you'd like

Transport clients should read the documented `A2A_AUTH_*` environment variables and include the corresponding headers in every request. The `extra_headers` per-call parameter should remain available for test-specific overrides (e.g. invalid credentials).

### Describe alternatives you've considered

Injecting auth at the conftest fixture level instead of the client level, but this requires every test to explicitly pass auth headers and is easy to miss.

### Additional context

A local patch adding env var reading to `JSONRPCClient.__init__` and merging into request headers confirmed the issue is purely missing wiring. Happy to submit a PR if the maintainers are interested.