Add support for multiple authentication challenges in WWW-Authenticate header

[waxlamp]

This adds a setting to enable emitting a comma-separated list of challenges in the WWW-Authenticate header that is returned with a 401 response.

Fixes #7328 and resolves #7812.

[waxlamp]

Is this line necessary? In my local build I was able to trigger the new error without it; I merely copied the pattern from the line above in my PR.

[auvipy]

I am not sure what benefit this will provide?

[yarikoptic]

I am not sure what benefit this will provide?

DRF supports having multiple alternative authentication schemes (which is great), but is not announcing that in the 401 WWW-Authenticate response field, which makes it impossible to have a DRF-powered service which would play nicely with clients which follow the standard treatment of WWW-Authenticate header field: they would see only the first available authentication mechanism (e.g. some non-standard "Token") and not some other available and known by then how to handle alternative authentication mechanism. So it then requires client-side knowledge of what particular authentication schemes a given DRF-powered service actually supports.

[waxlamp]

I am not sure what benefit this will provide?

Essentially, the value is in fulfilling the RFC's description of Www-Authenticate in the face of a DRF application that offers multiple authorization schemes, but does not advertise most of them.