[Client] Implement Protected Resource Metadata discovery (RFC 9728)

[soyuka]

Context

Per the MCP authorization spec (2025-06-18+), an unauthenticated client receiving a 401 MUST parse WWW-Authenticate: Bearer resource_metadata="<url>", fetch the indicated /.well-known/oauth-protected-resource document, and use it to locate the authorization server.

Scope

• Mcp\Client\Auth\ProtectedResourceMetadataDiscoverer:
  • Parse WWW-Authenticate for resource_metadata.
  • GET the URL, parse JSON.
  • Resolve authorization_servers[], bearer_methods_supported, scopes_supported, resource (audience).
• Validate resource matches the MCP server origin (defense-in-depth for auth/resource-mismatch, already passing).

Conformance scenarios unblocked

auth/metadata-default, auth/metadata-var1, auth/metadata-var2, auth/metadata-var3, auth/basic-cimd.

Dependencies

Blocked by: #316 (Bearer injection plumbs the 401 hook).

Acceptance

• Unit + integration tests against fixtures from the conformance fixtures dir.
• Conformance: 4 baseline scenarios above pass.

cc @soyuka