treat malformed s-maxage as absent in shared-cache auth check

[dxbjavid]

A shared cache must not store a response to a request that carried an Authorization header unless the response permits it through s-maxage, must-revalidate or public (RFC 9111 3.5). The guard treats any s-maxage as qualifying, but a malformed value like s-maxage=foo is parsed as 0 rather than -1, so it looks present and the authenticated response is stored in the shared cache and can later be handed to other clients on a revalidated hit. This tracks whether a valid s-maxage was actually supplied and uses that in the check, so a malformed directive is treated as absent as the spec requires; the numeric value is left unchanged so freshness behaviour is not affected.