x-goog-hash parsed from first header line only, missing MD5 or CRC32C checksums

Unconfirmed. This is the result of a search with Claude, may be a false positive.

When parsing the `x-goog-hash` response headers in `parse_http_response.rs`, `headers.get()` is used:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/storage/src/storage/read_object/parse_http_response.rs#L72-L93

Cloud Storage sends `crc32c=...` and `md5=...` as separate HTTP header lines. `HeaderMap::get` returns only the first value for that header name. Consequently, if `crc32c` is sent first, the `md5` hash is ignored and never validated. Conversely, if `md5` is sent first, `crc32c` validation is silently skipped.

Additionally, comma-separated tokens from `split(',')` are not trimmed of surrounding whitespace.

Start with src/storage/src/storage/read_object/parse_http_response.rs around lines 72-93 and inspect how x-goog-hash values are retrieved and split. Verify the parser handles separate header lines and trims comma-separated tokens. Done means both crc32c and md5 values are found and validated regardless of header order or surrounding whitespace.

Written by the indexing model from the issue text.