Improve HttpListener NTLM test failure diagnostics

[wfurt]

Summary

• replace the coarse NtlmHandshakeResult enum with a result that preserves authentication state, HTTP status, and the failing handshake stage
• keep the existing requirement that changing extended-protection policy between NTLM legs is rejected with HTTP 401
• improve assertion output so another occurrence of System.Net.Tests.HttpListenerAuthenticationTests fail with UnexpectedFailure #135190 identifies whether the failure came from token creation, challenge parsing, context timing, or the final response

This is primarily a diagnostic contribution to #135190 and may help narrow or stabilize the intermittent failure. We did not reproduce the original UnexpectedFailure, so this PR intentionally does not relax the expected behavior. We can watch CI for further occurrences and use the added details if it fails again.

Validation

• build.cmd clr+libs -rc release
• dotnet build /t:test src\libraries\System.Net.HttpListener\tests\System.Net.HttpListener.Tests.csproj: 695 total, 0 failed, 7 skipped
• NativeAOT Release build of System.Net.HttpListener.Tests
• NativeAOT Helix one-shot validation on Windows Server 2019/RS5, Server 2022, Server 2025, and Windows 11
• NativeAOT Helix stress validation: 50 fresh instances per queue, 200 total, all passed with the original HTTP 401 expectation

Note

This pull request description was prepared with GitHub Copilot assistance.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.