Follow-ups from #547: one test still disabled, two bugs its tests pin #560

Three loose ends from #547. None of them should have held up the merge; they just need to not get lost.

1. TemplateValueReplacerTests can be renamed to *Test now.
   The last commit on Add parser, response validator and digest auth tests; restore data type tests from #449 #547 kept it disabled "until Remove Guice to fix flaky tests #519", but Remove Guice to fix flaky tests #519 had already merged two days earlier and is in Add parser, response validator and digest auth tests; restore data type tests from #449 #547's base. The failure @NicoPiel reproduced was on a branch from before Remove Guice to fix flaky tests #519. Checked on main at 0638c21 with the file renamed: two 4-fork runs of the server suite, a single JVM running TcpDispatcherTest, TcpReceiverTest and ServerSettingsTest before it, and the whole suite (837 tests) in one JVM all pass. The same rename on 056475c, the commit before Remove Guice to fix flaky tests #519, fails with the NullPointerException from the review thread. One-file rename, happy to open it.

2. An XML ACK with an unknown code is treated as success.
   HL7v2ResponseValidatorTest.testXmlUnknownAckCodeLeavesStatusUnchanged pins this. On a running engine (same commit): a destination whose response is an XML ACK with MSA.1 = XX ends SENT, while the same code in an ER7 ACK ends in error with "Invalid HL7 v2.x acknowledgement received." AA and AE behave the same on both paths, so only the unknown-code case differs. The XML branch in HL7v2ResponseValidator has no fallthrough after the success-code check.

3. Digest auth accepts a request that omits the algorithm and qop directives, whatever the listener allows.
   DigestAuthenticatorTest.testNonceWithoutCountCanBeReused pins the nonce half. On a running engine with an HTTP Listener restricted to MD5-sess and auth-int: a request with no algorithm and no qop directive and the right password gets 200, handled as MD5 with no qop. Stating algorithm=MD5 or qop=auth gets 401, wrong password gets 401, MD5-sess with auth-int gets 200. Cause: DigestAuthenticator checks algorithm == null and qop == null before it checks the enabled sets. Effect for someone who has the password: no body integrity, and the header replays for the nonce's 60 s life with no nonce count. Needs the password, so not a break-in; still, the restriction doesn't restrict.

Co-authored with Claude Code.