mcp: add optional issuer validator for pre-registered client validation (SEP-2352) (#946)

Fixes #978

oauthex/client.go

@@ -18,6 +18,15 @@ type ClientCredentials struct {
 	// This is the most common authentication method for confidential clients.
 	// OPTIONAL. If not provided, the client is treated as a public client.
 	ClientSecretAuth *ClientSecretAuth
+
+	// Issuer is the issuer identifier of the authorization server these
+	// credentials are registered with. Pre-registered credentials are bound
+	// to a specific authorization server; when set, an error is returned if
+	// the discovered authorization server does not match, per SEP-2352.
+	// The comparison ignores a single trailing slash, matching the
+	// tolerance applied during RFC 8414 Section 3.3 metadata validation.
+	// OPTIONAL.
+	Issuer string
 }
 
 // ClientSecretAuth holds client secret authentication credentials.