zb: Don't disallow EXTERNAL auth in server handshake
If the transport can't handle EXTERNAL auth and it's included in the auth mechanisms, this particular mechanism will just be rejected and client will try the next one. So there is no need to disallow it.