feat(auth): add enterprise refresh-token and ID-JAG exchanges (#1234)

* feat(auth): request ID-JAGs with enterprise refresh tokens

* feat(auth): exchange ID-JAGs for MCP access tokens

Redeem ID-JAGs at the approved resource authorization server and return
its bearer token, lifetime, and effective granted scopes. Preserve scope
narrowing and redacted diagnostics, and reuse the default HTTP adapter.

Support independently configured client authentication at both servers.
Document the exchange profile and test redirects and staged failures.

Partially addresses modelcontextprotocol/rust-sdk#531.

* test(conformance): cover EMA refresh-token exchange

conformance/Cargo.toml

@@ -19,6 +19,7 @@ rmcp = { path = "../crates/rmcp", features = [
     "elicitation",
     "auth",
     "auth-client-credentials-jwt",
+    "auth-enterprise-managed",
     "request-state",
     "transport-streamable-http-server",
     "transport-streamable-http-client-reqwest",
@@ -31,6 +32,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 axum = { version = "0.8", features = ["macros"] }
 anyhow = "1"
+oauth2 = { version = "5.0", default-features = false }
 reqwest = { version = "0.13", features = ["json"] }
 urlencoding = "2"
 url = "2"