Opt-in OAuth HTTP exception for trusted local development hosts

[sudarsunperu]

Inspector v2 rejects OAuth token endpoints using http://host.docker.int, even when the endpoint is reachable only from a local Docker development environment.

Please consider an explicit opt-in mechanism, such as:

MCP_INSPECTOR_ALLOW_INSECURE_OAUTH_HOSTS=host.docker.internal

or a per-server configuration field. The override should:

• be disabled by default;
• require exact hostname matching;
• never allow arbitrary hosts or CIDRs;
• display a prominent warning;
• apply only to development/local environments.