Clean up Negotiate auth implementation to be a SoupAuth subclass

It would still be better if libsoup did this for us (cf. bug 587145) but
this is at least slightly cleaner than what we had before. And hopefully
leaves us in a better position to migrate to a 'real' solution provided
by libsoup... if that ever actually materialises.