GetProtectedResourceMetadataFromHeader was validating the resource field
against the metadata endpoint URL instead of the original server URL.
Per RFC 9728 section 3.3, the resource field must match the URL that the
client used to make the request to the resource server.
Fixes: #560
This package will hold externally visible parts of internal/oauthex.
For now, just add an alias to the ProtectedResourceMetadata struct. This
lets one write MCP-compliant servers.
