Add registry authorization specification (#756)

Add a standardized OAuth 2.1-based authentication specification for MCP
sub-registries, aligned with the MCP Authorization Specification.

This enables:
- Private registry entries with access control
- Permission-based server visibility
- Client code reuse (clients can use their existing MCP auth
implementation)

The spec is intended for downstream sub-registries. The official
registry remains public for reading.

Fixes #751

---------

Co-authored-by: Claude <noreply@anthropic.com>

docs/reference/api/generic-registry-api.md

@@ -4,6 +4,7 @@ A standardized RESTful HTTP API for MCP registries to provide consistent endpoin
 
 Also see:
 - For guidance consuming the API, see the [consuming guide](../../guides/consuming/use-rest-api.md).
+- For authentication and authorization, see the [registry authorization specification](./registry-authorization.md).
 
 ## Browse the Complete API Specification
 
@@ -22,8 +23,8 @@ The official registry has some more endpoints and restrictions on top of this. S
 Server names and version strings should be URL-encoded in paths.
 
 ### Authentication
-- **Read operations**: No authentication required
-- **Write operations**: Registry-specific authentication (if supported)
+
+No authentication required by default. Subregistries may optionally require authentication following the [registry authorization specification](./registry-authorization.md).
 
 ### Content Type
 All requests and responses use `application/json`