Fix the loot pickup check for an online RPG

Your RPG's loot pickup endpoint wrote whatever item, rarity and gold the client sent into the player's inventory, so players granted themselves legendary items. The fix treats the request only as "this player wants this drop" and takes the reward from the server's own record of the drop.

An assistant wrote resolve_pickup(world_drops, request). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• world_drops: the server's drops, each "dropId|itemId|rarity|gold|claimed|eligiblePlayerId". claimed is "0" for a drop nobody has picked up.
• request: the client's request, "playerId|dropId|itemId|rarity|gold". The last three fields are never trusted.
• Return "granted|<itemId>|<rarity>|<gold>" with the values from the server's drop, or "rejected|<reason>".

Rules the tests check, in this order:

1. The request must split on | into exactly 5 fields, or return "rejected|bad_request".
2. An empty player id returns "rejected|unauthenticated".
3. Find the first drop that splits into exactly 6 fields and whose drop id equals the request's. Skip drops that do not split into 6 fields. If none matches, return "rejected|unknown_drop".
4. If that drop's claimed field is not exactly "0", return "rejected|already_claimed".
5. If its eligible player is not the requesting player, return "rejected|not_eligible".
6. Otherwise return "granted|" and the drop's item id, rarity and gold.

• All comparisons are exact.