docs(spec): restamp the turso ?authToken= reading on the @libsql/core 0.18.0 this tree now pins

The TSDoc of CREDENTIAL_URL_QUERY_PARAMS says each entry is measured
"in the versions pinned by this tree" and named @libsql/core 0.17.4;
with the client lifted to ^0.18.0 the tree pins only core 0.18.0, so the
label would have been false in the release that ships it. Its echo in
driver-credential-refusal.test.ts moves with it.

Re-measured on the installed @libsql/core 0.18.0 (expandConfig, with a
config-level authToken 'BINDER'):
- url ?authToken=URLTOK          -> authToken URLTOK (the URL overrides)
- url ?auth%54oken=URLTOK        -> authToken URLTOK (key percent-decoded)
- url ?AuthToken= / ?token=      -> URL_PARAM_NOT_SUPPORTED
- control, no query string       -> authToken BINDER
Identical to the 0.17.4 reading; core 0.17.4 and 0.18.0 differ only in
their package.json version.

Claude-Session: https://claude.ai/code/session_018gA1pE6eJtwHhqx72G8U9X
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/spec/src/data/driver/common.zod.ts

@@ -266,7 +266,7 @@ export function urlUserinfoUsername(value: string): string | undefined {
  * Every entry is MEASURED against the client the driver actually hands the URL
  * to, in the versions pinned by this tree — never inferred from documentation:
  *
- *  - `turso: ['authToken']` — `@libsql/core@0.17.4` `expandConfig` reads
+ *  - `turso: ['authToken']` — `@libsql/core@0.18.0` `expandConfig` reads
  *    `?authToken=` from the parsed URL and assigns it OVER the config-level
  *    `authToken`, so a query-embedded token does not merely authenticate: it
  *    silently overrides the secret the datasource binder injects at connect.

packages/spec/src/data/driver/driver-credential-refusal.test.ts

@@ -322,7 +322,7 @@ describe.each(URL_FAMILY)('$name — URL-embedded credential refusal (#8082)', (
 /**
  * The query-parameter spelling of the same secret (#8337) — refused only where
  * a MEASURED client reads it: turso `url`/`syncUrl` `?authToken=`
- * (`@libsql/core@0.17.4` assigns it OVER the binder-injected token) and
+ * (`@libsql/core@0.18.0` assigns it OVER the binder-injected token) and
  * postgres `url` `?password=` (`pg-connection-string@2.14.0` copies every
  * query parameter into the client config, winning over userinfo).
  */