mcp: Add client-side scope accumulation (#944)

## Description

This PR implements
https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2350

Fixes #943

---------

Co-authored-by: Maciej Kisiel <mkisiel@google.com>

internal/authutil/scopes.go

@@ -0,0 +1,36 @@
+// Copyright 2026 The Go MCP SDK Authors. All rights reserved.
+// Use of this source code is governed by the license
+// that can be found in the LICENSE file.
+package authutil
+
+import (
+	"maps"
+	"slices"
+	"strings"
+
+	"golang.org/x/oauth2"
+)
+
+// UnionScopes returns the union of the existing and challenged scope sets.
+// It is used during step-up authorization to accumulate scopes across
+// authorization rounds (SEP-2350).
+func UnionScopes(existing, challenged []string) []string {
+	combined := make(map[string]struct{})
+	for _, s := range existing {
+		combined[s] = struct{}{}
+	}
+	for _, s := range challenged {
+		combined[s] = struct{}{}
+	}
+	return slices.Collect(maps.Keys(combined))
+}
+
+// ScopesFromToken extracts the granted scopes from an OAuth2 token response.
+// Per RFC 6749 §5.1, the scope parameter is optional; returns nil if absent.
+func ScopesFromToken(token *oauth2.Token) []string {
+	scope, ok := token.Extra("scope").(string)
+	if !ok {
+		return nil
+	}
+	return strings.Fields(scope)
+}