Add unit tests for DefaultAuthenticator role resolution logic

### Describe the bug

## Summary

`DefaultAuthenticator.extractRequestedRoles()` and `resolvePrincipalRoles()` contain non-trivial logic for parsing scope strings, filtering by the `PRINCIPAL_ROLE:` prefix, and resolving active principal roles, but currently lack dedicated unit test coverage.

The existing `DefaultAuthenticatorTest` verifies principal lookup and error handling, but does not exercise the role extraction and resolution code paths.

## Scope

Add unit tests covering:

- `extractRequestedRoles()`
- `PRINCIPAL_ROLE:ALL` returns the "all roles" semantic
- extraction of individual role names
- filtering of scopes with invalid prefixes
- mixed valid and invalid scopes
- empty or missing role scopes

- `resolvePrincipalRoles()`
- activating all granted roles when `ALL` is requested
- activating only the requested roles when specific roles are provided
- ignoring requested roles that are not granted to the principal
- handling empty requested-role sets

## Why

These methods were recently modified and contain branching logic with several edge cases, including invalid scope prefixes and the special handling of `ALL` via empty-set semantics. Adding targeted unit tests will improve coverage and help prevent future regressions.

### To Reproduce

_No response_

### Actual Behavior

_No response_

### Expected Behavior

_No response_

### Additional context

_No response_

### System information

_No response_

Start with DefaultAuthenticatorTest and the DefaultAuthenticator methods extractRequestedRoles() and resolvePrincipalRoles(). Add focused tests for valid, invalid, mixed, empty, ALL, granted, and ungranted role cases described in the issue, then run the relevant unit tests. Done means the role parsing and resolution branches have dedicated regression coverage.

Written by the indexing model from the issue text.