Per review feedback on #7331: cover comma, pipe, newline, mixed
separators, repeated/adjacent separators, and surrounding whitespace
directly against _trusted_groups_header_value(), in addition to the
existing end-to-end bound_profile regression test.
Authentik's proxy provider on this deployment joins multiple group
names with "|" instead of "," (e.g. "admins|developpeur"). The
comma-only split in _trusted_groups_header_value() treated that whole
string as a single unmatched group name, silently dropping the
session to the unbound "default" profile even for identities that
are legitimate members of a mapped group. Single-group identities were
never affected since there was no separator to parse.
Accept comma, pipe, and newline as equivalent separators so the parser
works regardless of which the outpost happens to send.
SuperAgent BEAM3