[Client] Implement Authorization Server Metadata discovery (RFC 8414)

[soyuka]

Context

Once the AS issuer is known (from PRM), the client must fetch its metadata at /.well-known/oauth-authorization-server (RFC 8414) to learn the authorization_endpoint, token_endpoint, registration_endpoint, scopes_supported, token_endpoint_auth_methods_supported, and grant_types_supported.

Scope

• Mcp\Client\Auth\AuthorizationServerMetadataDiscoverer.
• Cache resolved metadata per issuer (TTL via PSR-16 if TokenStorage is backed by it).
• Fall back to OpenID Connect discovery (/.well-known/openid-configuration) when RFC 8414 endpoint 404s.

Conformance scenarios unblocked

auth/metadata-* (full set), auth/scope-from-scopes-supported.

Dependencies

Blocked by: #317 (PRM provides the issuer URL).

Acceptance

• Unit tests covering RFC 8414 + OIDC fallback.
• Reuses existing Mcp\Server\Transport\Http\OAuth\OidcDiscovery for shape parity if practical.

cc @soyuka