fix: prevent OAuth resource spoofing

[DaleSeo]

Motivation and Context

This fixes an OAuth protected-resource metadata spoofing issue by requiring discovered RFC 9728 metadata to identify the same MCP resource the client is connecting to. Without this check, a malicious MCP server could advertise another resource's authorization server and trick clients into sending access tokens to the wrong server. The change rejects missing or mismatched resource values before trusting advertised authorization servers or scopes, while preserving the root URL slash normalization needed for existing local-server flows.

How Has This Been Tested?

Added tests

Breaking Changes

This is intended to be a non-breaking security fix.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context