fix(auth): preserve issuer trailing slash during discovery

[satouriko]

Motivation and Context

Authorization server metadata discovery currently reconstructs the expected issuer from the generated discovery URL. For a path-based issuer ending in a trailing slash, RFC 8414 path insertion removes that slash, so the reverse transformation is lossy and valid metadata is rejected with an issuer mismatch.

This change preserves the exact authorization server identifier advertised by Protected Resource Metadata and uses it for validation. Discovery URL generation and strict issuer comparison remain unchanged.

Fixes #1144

How Has This Been Tested?

• Verified the new regression test fails on origin/main with AuthorizationServerMismatch
• cargo test -p rmcp --lib --features auth protected_resource_metadata_preserves_non_root_issuer_trailing_slash -- --nocapture
• cargo test -p rmcp --lib --features auth authorization_metadata -- --nocapture
• cargo +nightly fmt --all -- --check
• cargo clippy -p rmcp --all-targets --all-features -- -D warnings
• cargo test -p rmcp --all-features

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

The fix intentionally does not normalize non-root trailing slashes. https://auth.example.com/tenant and https://auth.example.com/tenant/ remain distinct issuer identifiers; validation now compares metadata against the original identifier rather than a reconstructed one.

[DaleSeo]

Thanks for the fix, @satouriko!