[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68

`~` is a member of RFC 7235 §2.1 `token68`,
and thus of RFC 6750 §2.1 `b64token`,
but the allowlist stripped it,
silently corrupting any opaque Bearer credential containing it:

    Bearer mF_9.B5f-4.1JqM~+/=  ->  Bearer mF_9.B5f-4.1JqM+/=

`Basic` credentials were never affected,
since RFC 4648 §4 base64 cannot emit `~`;
`;` stays stripped, as it belongs to no auth-scheme production.

Cover the charset in the unit test,
and assert the credential reaches the downloader intact via the existing fake-`wget` harness,
which needs no container.

nvm.sh

@@ -190,9 +190,10 @@ nvm_sanitize_auth_header() {
     # and base64url (A-Za-z0-9-_=) charsets, plus the space, colon, dot, and
     # underscore the previous allowlist already permitted, so that values like
     # `Basic <base64>` and `Bearer <token>` survive intact.
-    # token68's '~' is still stripped.
+    # '~' is also allowed, completing RFC 7235 `token68` (and thus RFC 6750
+    # `b64token`), so opaque Bearer tokens containing it are not corrupted.
     # Note: '-' must be at the end of the bracket expression to be treated as a literal.
-    nvm_echo "$1" | command sed 's/[^a-zA-Z0-9 :_.+/=-]//g'
+    nvm_echo "$1" | command sed 's/[^a-zA-Z0-9 :_.+/=~-]//g'
 }
 
 nvm_has_system_node() {