I wanted this too, very recently. After digging I found out the IANA maintains a list of links to relevant RFCs here: https://www.iana.org/assignments/http-authschemes/http-auths...
They can be a slog, but the effort is worth it since the information is reliable.
I want to read the newer RFCs around JMAP next.