Add registry authorization specification (#756)

Add a standardized OAuth 2.1-based authentication specification for MCP
sub-registries, aligned with the MCP Authorization Specification.

This enables:
- Private registry entries with access control
- Permission-based server visibility
- Client code reuse (clients can use their existing MCP auth
implementation)

The spec is intended for downstream sub-registries. The official
registry remains public for reading.

Fixes #751

---------

Co-authored-by: Claude <noreply@anthropic.com>

docs/reference/README.md

@@ -5,6 +5,7 @@ Technical specifications and quick lookups for the MCP Registry.
 ## API Reference
 
 - [Generic Registry API](./api/generic-registry-api.md)
+- [Registry Authorization](./api/registry-authorization.md)
 - [Official Registry API](./api/official-registry-api.md)
 
 ## server.json Reference